SharePoint 2010/2013: Using PowerShell script to Select / Unselect specific containers for User Profile Sync connection.
In Sharepoint 2010 / 2013, when clicking on “Populate containers” for creating a sync connection you may not see all the items displayed, hence you may not be able to select / unselect containers that are not visible in the Tree-view. The number of items to show in this view has been limited to 1000 considering the Performance issues. When you select the root OU, all the objects in the OU will be marked for synchronization by default. You may expand the Tree and un-select the containers, however once it reaches the display limit you will not be able to view them and unselect.
Here is the sample PowerShell Script that can be used to unselect an OU that’s not visible in the UI view. The value for the connection name should be updated. If you have more than one User Profile service application, the script is going to select the first one.
#---Begin---
$snapin = Get-PSSnapin | Where-Object {$_.Name -eq 'Microsoft.SharePoint.Powershell'}
if ($snapin -eq $null)
{
Write-Host "Loading SharePoint Powershell Snapin"
Add-PSSnapin "Microsoft.SharePoint.Powershell"
}
$ups = @(Get-SPServiceApplication | Where-Object {$_.TypeName -eq 'User Profile Service Application'})[0] #Picks up the First User profile service application.
$context = [Microsoft.SharePoint.SPServiceContext]::GetContext($ups.ServiceApplicationProxyGroup,[Microsoft.SharePoint.SPSiteSubscriptionIdentifier]::Default)
$ConfigMgr = New-Object Microsoft.Office.Server.UserProfiles.UserProfileConfigManager($context)
$AD = $ConfigMgr.ConnectionManager['2013Connection'] #2013Connection is the connection name
$NamingContext = $AD.NamingContexts[0]
$ContainersExcluded = $NamingContext.ContainersExcluded
$ContainersIncluded = $NamingContext.ContainersIncluded
$ContainersExcluded.Add('CN=Users,DC=Contoso,DC=com')
$ContainersIncluded.Remove('CN=Users,DC=Contoso,DC=com')
$CloneDSNC = new-object Microsoft.Office.Server.UserProfiles.DirectoryServiceNamingContext(
$NamingContext.distinguishedName,
$NamingContext.DomainName,
$NamingContext.IsDomain,
$NamingContext.ObjectId,
$ContainersIncluded,
$ContainersExcluded,
$NamingContext.PreferredDomainControllers,
$NamingContext.UseOnlyPreferredDomainControllers
)
$NamingContexts = $ad.NamingContexts
$NamingContexts.Remove($NamingContext)
$NamingContexts.Add($CloneDSNC)
$ad.NamingContexts = $NamingContexts
$ad.Update()
#---End-----
# This sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment. THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code, provided that. You agree: (i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded; (ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded; and (iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys’ fees, that arise or result from the use or distribution of the Sample Code.
Script Credit: Abhishek Saigal [MSFT]
Post By : Manjesh Menon [MSFT]
Comments
- Anonymous
February 28, 2017
Thanks for this excellent post. I tried running this script, but the issue is that UPS Sync fails. I will have to manually go to FIM console and then reenter our sync account credentials(But making any manual change to FIM is not supported by Microsoft for SharePoint). In UI for UPS, we can enter these credentials only after which we get to populate containers. Is there a way to pass the sync account credentials using the above script?- Anonymous
February 28, 2017
Hi Santhosh ,Its not a good practice to pass the credentials with in the script. We haven't seen the sync fails after the script is executed. However , if you experience so , please use the SharePoint UI and edit the Sync connection , key in the password and click on populate containers. This screen now should show the right OUs selected as the script is already executed. Then you can click ok (without making any changes to the OU through UI). This will help the SharePoint to send all the information to FIM including the credentials. Hope this clarifies your question.
- Anonymous
- Anonymous
April 19, 2017
Hi There, I'm still facing issues with the limit and this script. My Problem is I need to deselect a sub-Ou, but the ContainersIncluded do not have all values (it seems to be also the 1000 item limit) Structure: Domain-> OU1 -->SUBOU1 --->SUB_SUBOU1 ---->SUB_SUB_SUBOU1 (in this OU many user objects exists)----->SUB_SUB_SUBOU1 (this one I would like to deselect, name starting with a 'G' but unable to deselect)Do you know if there is also a limitation through Powershell? And do you have a workaround how I can deselect this subou? best regards and thanks in advanced nadine- Anonymous
April 26, 2017
Hi Nadine, We haven't observed any limitation with PowerShell, however to comment on this further we may have to analyze a few scenarios and look at logs etc. It would be great if you could create a support case and contact us. We will further look in to this deeper.
- Anonymous
- Anonymous
June 22, 2017
Script stops on Cannot index into a null array.At D:\spscripts\userprofileservice\set_UserProfileServiceApplication.ps1:20 char:1+ $NamingContext = $AD.NamingContexts[0]+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [], RuntimeException + FullyQualifiedErrorId : NullArrayConnection name is correct, but for some reason not picked upPlease adviseRegards Sam- Anonymous
July 02, 2017
Hi Sam,Please make sure that the variable $AD has the right value. if not, you me have to check the value for $ConfigMgr . It a good practice to print all the variable values till $ad ($ups ,$context $ConfigMgr ,$AD ) to understand which of these got a null value.
- Anonymous