Wednesday, January 16, 2013

User Profile between SharePoint and AD out of synch

There are many reasons that user profile information displayed in SharePoint may be out of synch with the information in AD. One such reason is name change because of marriage.

If the Account Name is changed, you can use the "stsadm -o migrateuser -oldlogin xxx\abc -newlogin xxx\xyz -ignoresidhistory" command to migrate the old user to the new user.

For display name change, deleting the user from the site collection user information list should fix the problem. You can access this hidden list by going to http://xxx/_catalogs/users/simple.aspx page.
To delete the user, go to: http://xxx/_layouts/userdisp.aspx?Force=True&ID=xyz make sure id is correct for the user, then click "Delete User from Site collection".
You may also want to delete the user from the user profile of the central 
administration too. 

This post from Todd Klindt explains above stsadm command really well. 

See also on how to remove a user from a SharePoint 2010 site collection.
Here is the basic steps from above post:
  1. As a site collection administrator, click Site Actions –> Site Permissions
  2. Click into any existing group (like site Owners).  The URL will be something like http://server/_layouts/people.aspx?MembershipGroupID=28.
  3. Change the 28 to a 0.  The list should now show you All People. 
  4. Find the user, click the checkbox by their name.  Click Actions, Delete Users from Site Collection.
  5. Now add the user back to the appropriate group.
The following powershell commands may be handy too:

Set-SPUser -Identity ‘Domain\username’ -DisplayName ‘Last, First’ –Web http://SharePointSe rver*
This forces a manual sync of properties from AD

Set-SPUser -Identity ‘Domain\username’ –Web http://SharePointServer –SyncFromAD*

To force Sync of all users,
Get-SPUser –Web http://SharePointServer | Set-SPUser –SyncFromAD*