We have a very simple SharePoint Server 2010 SP1 installation. We created and configured everything manually, and only set up what we really needed. So there is no user profile service in SP, and we only use Windows authentication, no claims, no forms. We only have one domain.

To be honest, I didn't even completely understand the purpose of UPS, the "advertisements" didn't seem accurate enough and I didn't care to read more about it back then because everything worked without it. We've never had UPS and we can see peoples' login names, real names, email addresses, etc. just fine inside SharePoint. What does UPS actually give us? The ability to sync even more properties from AD to SP and/or the ability to sync users and properties from SP to AD? Can't SP sync anything from SP to AD without UPS?

Anyway, to the real question. A new feature request came up: we need the ability to create new users without ADUC from the web (not necessarily but preferably SharePoint), while not affecting or endangering the current users in any way. What's the simplest route?

I think the nicest way is to install UPS. UPS is a pain to set up and configure, but it seems like it's the perfect tool for the job. Am I right? Can it be set up so that we delegate a new OU for this purpose, new users by SharePoint will be created in this OU, while current users will remain in another OU where they are now, SP will have no control over them, and they will still be able to login? Forms/claims auth and anything else is not needed for this way, right?

Do the new users have to be in an AD at all? Does SharePoint have the ability to create users in the content databases or something? Or should we poke around forms and claims authentication? What other ways are there? Or should we just leave SP as is, and create a simple, custom application for AD user registration and that's all?

3 Answers 3


UPS isn't going to help you in any way. It's only for syncing more properties between SharePoint and AD (and possible also other sources of user info like payroll system,...). But It'll never create new users in AD.

In fact out of the box SharePoint has no was of creating new users in any store. SharePoint doesn't care about authentication (finding out who the user is) it only cares about authorization (what they are allowed to access/do) once something else has figured out who they are.

So you have to figure out somewhere to store these new users and if thats not AD then enable claims instead of windows authentication and convert all existing users to claims users (event though they can still log in using windows accounts).

If you're OK with having the new users in a separate OU in AD, then I think that'll be the least disruptive. Add then either develop or buy some tool for maintaining these new users in AD.

  • You saved my life.
    – fejesjoco
    Commented Jul 28, 2012 at 5:56

I'm a big fan of UPS, but that's because of its social aspects and features you can enable with my sites. There is something nice about dynamically generated org charts, the ability to follow people, and having a central store of profile info rather that having to rely on the user information list. It's also nice to be able to push some of the user maintenance down to the employee and allow them to update their own phone info, etc. we've used the skills and past projects fields extensively as well for quick searched on skills like "fluent in Spanish" as an example.

That being said, if you're looking to add users for external web access, extend your web app to a new domain and set a different authorization store for the zone. It can even be FBA without touching how authorization works internally. Or you can set up an instance of ADAM for the externally accessible zone so as to us an AD like store while still preserving your internal AD and leaving it "pristine", which will make your security group happy.

  • Thanks, at least I know what UPS really is for and UPS is really not what I want. Totally not worth the trouble setting it up, it can produce lots of errors and demands lots of hotfixes, shame...
    – fejesjoco
    Commented Jul 28, 2012 at 5:55

You can have new users as NT accounts. I've done this successfully in production. There are also third party tools that will help you create the accounts straight from SharePoint.

Try this link:


We have interchangable domain users and local machine users outside the domain access the same content, so it won't touch your current OU or configuration.

  • Well it's not ADUC but the same idea, you have to log on locally.
    – fejesjoco
    Commented Jul 28, 2012 at 5:53
  • No it is ADUC. Each outside user has a ADUC account.
    – Mike
    Commented Jul 30, 2012 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.