Can anyone confirm for me that the User Profile to SharePoint Full Synchronization timer job must run in order to remove ophan ad users from a site collection? From my understanding this will remove the record from the profile database and then remove the user from the site collection's userinfo table.


A full synchronization is not needed to remove the entries from the User Profile database only a incremental followed by My Site Cleanup. See Account Deletion and SharePoint 2010 User Profile Synchronization

But this will not remove users from the Site collections userinfo table, there is no automatic deletion happening here. If you want to do the clean up you can use Clean-up User Information List

| improve this answer | |
  • You're telling me SharePoint did not include a timer job to remove oprhan AD users in a site collection? I was thinking of writing a powershell script to the clean up on the user information lists on my site collections, but I just find that hard to believe. – Brandon Michael Hunter Jun 1 '12 at 21:23
  • 1
    Yes, SharePoint the Userlist is part of SharePoint Foundation which has no expectation about access to AD and don't like the idea of users disappearing as all user columns like Created By and Modified By are lookups into this list. – Per Jakobsen Jun 2 '12 at 18:51
  • That's a good point.!I guess my next question is what are people doing with these orphan ad users that lives inside of their user info tables? – Brandon Michael Hunter Jun 3 '12 at 13:17
  • Any information related to a user object is stored in a reference to the entry of the user info table. If a user uploads a document (or any list item) the information of the user who created the entry is stored not ith the AD SAM Account information (company\johndoe) but with an integer coming from this list. So if you delete the entry rom the user info list these information will be corrupted. This list is needed for performance reasons. If sharepoint would look up every entry in AD this will ruin performance (if not already bad ;-) ). Just don't mess with this list. – Marco Scheel Aug 13 '12 at 13:03

By and large, most companies do not want orphaned AD users removed at the site collection level. Consider the following scenario:

  1. Person A joins your company.
  2. Person A writes and edits several documents.
  3. Person A leaves the company.

If you remove Person A from the site collection after they're removed from AD, you lose all reference to Person A in the Author and Editor fields. 5 months down the line, if your clients want to know whether Bob from accounting who got canned wrote the 3rd draft of this proposal or if it was Angela from sales who moved on to a better position elsewhere, you might just be out of luck.

My general recommendation is to leave users in at the site collection level unless AD is reusing login names, and even then only remove the users from site collections the new user is utilizing.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.