3

I edited my connection in user profile service to filter out disabled users after that I run full sync to exclude the deleted users

Then I run the PowerShell script in this post

User Profile Inactive Profiles Not Deleting

Finally I Run mysite clean up jobs, but the user profile still shows the disabled users, am I missing something?

Fabio
  • 580
  • 10
  • 26
  • 1
    It sounds like you're using AD Import, is that correct? AD Import does not apply filters for objects that already exist in the UPSA -- MIM will, however. –  Nov 06 '18 at 21:49
  • Yes, I am using AD import, is there a workaround to apply filters for objects that already exists – Fabio Nov 06 '18 at 22:30
  • 1
    The workaround is to use Microsoft Identity Manager instead. –  Nov 07 '18 at 00:27
  • We don't have MIM recreate connection is not option!! – Fabio Nov 07 '18 at 00:30
  • Then you need to purge the accounts by script/hand. AD Import was not the correct choice for you if you wanted this functionality. –  Nov 07 '18 at 00:48

2 Answers2

4

You're missing the step "Mark non-imported profiles for deletion" in these four steps:

ADI Step 1: Determine if the profile is already marked for deletion.

  • Run this SQL query against the Profile database:
  • Select * from upa.userprofile_full where bDeleted = 1

ADI Step 2: Run a Full Import.

  • "Out of Scope" (deleted, filtered, moved to a non-imported OU) users do not have their profiles automatically cleaned up by an incremental import. With AD Import, we don't use the Sync database to store "state" information about each user. As such, the only way AD Import can tell if a user has fallen "out of scope" is to import them. If the user object has not changed in AD, an incremental import will not pick them up. Luckily, AD Import is fast, so running a Full Import is not a big deal.

ADI Step 3: Mark non-imported profiles for deletion.

  • Run the following PowerShell to get a list of all your unmanaged profiles:
  • $upa = Get-spserviceapplication | ?{$_.typename -match "profile"}
  • Set-SPProfileServiceApplication $upa -GetNonImportedObjects $true | out-file c:\temp\NonImportedProfiles.txt
  • If the target profiles show up in the "NonImportedProfiles.txt" file, then you need to manually mark them for deletion with PowerShell:
  • $upa = Get-spserviceapplication | ?{$_.typename -match "profile"}
  • Set-SPProfileServiceApplication $upa -PurgeNonImportedObjects $true
  • If the target profiles are managed profiles, not marked for deletion, and you have run a Full Import, then you need to look into why AD Import is not marking them for deletion.
  • Document your connection filter and selected OUs / containers and check your target profiles against them. If you're using a complex LDAP filter on your import connection, you should consider using an LDAP tool like LDP.exe or LDAP Browser to test the LDAP filter and make sure it includes and excludes the users you think it should.

ADI Step 4: My Site Cleanup Job

  • While "Set-SPProfileServiceApplication $upa -PurgeNonImportedObjects $true" marks out-of-scope profiles for deletion, it doesn't actually delete anything. That's left to the My Site Cleanup Job.
  • Check Central Administration | Monitoring | Timer Jobs | Review Job Definitions | My Site Cleanup Job. Make sure it's set to run at least once per day.
  • Important: In SharePoint 2016, there were some major changes made to how the My Site Cleanup Job works. Instead of immediately deleting profiles that are marked for deletion, it schedules the profiles to be deleted after 30 days. The 30-day setting is hard-coded. There is no way to change it. Also, if your build is pre-August 2017 CU (16.0.4573.1002), this functionality does not work at all, even after 30 days. You'll need to upgrade. See this post for details: https://blogs.msdn.microsoft.com/spses/2017/05/22/sharepoint-2016-mysitecleanup-job-functionality-changes/

Reference: SharePoint: The complete guide to user profile cleanup – Part 4 – 2016

Benny Skogberg
  • 25,542
  • 12
  • 68
  • 163
0

If you are using AD Import

Run The below script, It will export all the sharepoint users email and check user email is present in Active Directory or not if the user id is not present in AD it will delete the users froms. SharePoint user profile.

I was facing the same issue so i have written a powershell script to resolve it. Make changes in the script according to your need.

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

#Web Appplication URL
$siteUrl = "https://sharepoint.net"

$Sites =Get-SPSite -Identity "$siteUrl"

#Creating Connection With SharePoint $Context = Get-SPServiceContext -Site $siteUrl
$userprofileManager = New-Object Microsoft.Office.Server.UserProfiles.UserProfileManager($Context);
$Userprofiles = $userprofileManager.GetEnumerator()

#crating Empty Arrays to store Users not in AD and All the Sharepoint user ID emails
$Allemails = @() $usersnotinAD = @() $Userdetails = @() $AllSites = @()

#Exporting SharePoint Users email IDs foreach ($Userprofile in $Userprofiles) {

$StoreUsers = [PSCustomObject]@{    
                            Workemail = $userprofile["workemail"].value
                            Accountname = $userprofile["AccountName"].value                                
                             }

$Userdetails += $StoreUsers

$Allemails += $userprofile["workemail"].value

}

#exporting Username and email id to csv $Userdetails | Export-csv E:\scripts\UserProfile\usernameandemailid.csv -NoTypeInformation

#Filtering out the EmailID's Ending with google.net #$emails = $Allemails | Where {$_ -like "*@google.net"}

foreach ($email in $Allemails) {

#verifying User profile has email id or not
 try{

    $ExistingADUser = Get-ADUser -Filter "EmailAddress -eq '$email'"

#if user is not present in AD it will perform below operations
if($null -eq $ExistingADUser)

    {
   # $user = $ExistingADUser.Name
    write-host "$email does not yet exist in active directory" -BackgroundColor Red
    $usersnotinAD += $email

    $inputCSV ="E:\scripts\UserProfile\usernameandemailid.csv"

    #import the csv file to dbrows

    $dbRows = IMPORT-CSV $inputCSV

            foreach ($dbRow in $dbRows)

                {


                   if($dbRow.Workemail -eq $email)
                   {


                    #Fetch user Profile 
                    $UserProfile = $UserProfileManager.GetUserProfile($dbRow.Accountname)

                    #remove user profile
                    $UserProfileManager.RemoveUserProfile($dbRow.Accountname);

                         #Remove User from the UIL
                          foreach($Site in $Sites)
                                {
                                    #Get the rootweb for the site collection
                                    $RootWeb = $Site.RootWeb
                                    $passname = $dbRow.Accountname
                                    #change prefix as per user profile 
                                    $userpreffix = "i:0#.w|"

                                    $newname = $userpreffix + $passname

                                    #Remove the user from the User Information List
                                    Remove-SPUser -Identity $newname -Web $RootWeb -Confirm:$False
                                }


                   }


                }

    }

else
{
     write-host "$email exists in active directory" -BackgroundColor Green
}

}

catch [System.Exception]{

         write-host "Email id is not present for the user " -BackgroundColor red




}

}

$usersnotinAD | Out-File E:\scripts\UserProfile\usersnotinAD.txt

$Allemails | Out-File E:\scripts\UserProfile\ExportedSharePointEmailIDs.txt

prabhat
  • 11
  • 1