I am very new to SharePoint (2010 in this case) and have been tasked with writing a PowerShell script that will synchronize some information between Active Directory and SharePoint users.

I figured that using the SID would be the best choice in doing that, but when we run get-spuser, everyone's SID is null (and rawsid too, of course). Is the command being used incorrectly? Are the SP users being added incorrectly? I am not the admim of this computer system, so I don't know how they are being added, but if someone can tell me the correct question to ask (this way vs. that way, for example) I will ask.

Thanks, Jim

1 Answer 1


SharePoint has native functionality to synchronize Active Directory information via User Profile Synchronization (which is essentially a lightweight version of Forefront Identity Manager that's bundled inside of SharePoint). That would likely be the method you'd want to use to do this, not via PowerShell. Pushing updates via PowerShell may be erased when the next UPS sync runs, so you're far better off having SharePoint manage all of the data.

If you're unfamiliar with UPS...

User Profile Synchronization (UPS) is a service application that gets provisioned within SharePoint Central Administration, pointed to the applicable domains/OU's, and synchronizes on a schedule (ie: every night) to bring AD information (manager, title, etc.) into SharePoint. There's then an hourly timer job that pushes that UPS data to the individual site collection user information lists (you "shouldn't" have a need to touch the individual SPUser objects to do this if your farm is setup correctly. On a side note, you can also setup custom fields and mappings, or use SharePoint BDC to also synchronize to third party HR systems for fields, as needed.

If UPS isn't setup, Spencer Harbar has one of the best guides to implementing UPS available on his blog. UPS can be a little picky, and has to be setup exactly in the right order or it won't work, so follow his guide and you'll be good. UPS has a tenancy to need to be fixed or reconfigured after Service Pack installs simply because it is so finicky, but once you've done it a few times it's simple. If you're running Service Pack 1, you'll want to make sure you're also running at least the June 2011 Cumulative Update as it provides some additional fixes to UPS that were missed in Service Pack 1.

  • Thanks for the info, I will ask if they have tried UPS yet. One that that I forgot to mention, that may make a difference, is that this is for a company that is doing Hosted SharePoint. This is a company that will be "renting out" SharePoint to clients that do not want to install it on their own hardware. So, different clients will be in different AD Org Units. I don't know if UPS is up to that (have yet to read up on it.) But, any clue as to why I might have NULL SIDs though? I would guess that even UPS would use it for syncing.
    – Jim
    Apr 15, 2012 at 22:40
  • Multi-tenanted solutions get a bit more complicated, but the larger SharePoint hosting companies (al la FPWeb and Rackspace) offer it, though depending on the services the client is using it may vary. SharePoint does support multi-tenanted solutions, and UPS will allow you to sync to a specific OU (since it's a service app, you could provision as many as you need and restrict to specific web apps). As for the NULL SID, SharePoint assigns a unique ID for new SPUser objects, but I'm not sure if it pulls the AD SID or not. I'm not as familiar with that side, others may chime in on that.
    – webdes03
    Apr 15, 2012 at 23:14
  • You may try grabbing a SPUser object and doing a Get-Member on it to see what's in there. I can't recall if the actual AD SID gets stored or not without UPS doing the sync. Once you get UPS setup (if you go that route), the whole object model around UPS becomes available, so even making little changes via PowerShell becomes much easier (and they can push back to AD if you wish to set it up that way).
    – webdes03
    Apr 15, 2012 at 23:15
  • I spoke to my boss who is the interface with this client and he says they are against using UPS and want something simpler, thus, my project. As far as doing SPUser and piping it into Get-Member, yes, sid and rawsid are both properties, they are just null. Thanks for your suggestions.
    – Jim
    Apr 16, 2012 at 1:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.