Filters in SharePoint User Profile Synchronization Connections

When setting up user profile synchronization in SharePoint we have to provide filters in order to import users on a specific criteria. say, we don’t want to import disabled users. By default SharePoint pulls all the users from the directory source (usually Active Directory).

SharePoint 2010 has a nice user interface, where you will be able to select filter.

• Go to Central Administration >> Application Management >>
• Manage Service Applications >> User profile service application >> Configure Synchronization Connections >> Edit connection Filters

Select the attributes and set the operator & values accordingly. Here I’ve set the condition to exclude disabled accounts.
SharePoint will filter disabled accounts in a user profile. You can select desired attributes, group them and apply AND/OR conditions further.

But in MOSS 2007 you have to enter the filter in user profile synchronization manually.
Go to Central Administration >> SSP >> User Profiles and Properties >> Configure Profile Import >> User Profile Connections
 
 Click on Configure Profile Import

Edit the Import connection

and set SharePoint user profile filters. 

Frequently used filters in SharePoint user profile synchronization connection:

By default, user filter will be:
(&(objectCategory=Person)(objectClass=User))

SharePoint user profile filter to disable accounts/users:
(&(objectCategory=person)(objectClass=user)( !(userAccountControl:1.2.840.113556.1.4.803:=2)))

Include only the accounts with valid email addresses
(&(objectCategory=Person)(objectClass=User)(mail=*com)

Exclude accounts disabled and which has no E-Mails:
(&(objectCategory=Person)(objectClass=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(mail=*))

Exclude accounts with passwords set to expire:
(&(objectCategory=person)(objectClass=user)(!userAccountControl=65536))

Exclude accounts that don’t have a first name
(&(objectCategory=Person)(objectClass=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(!givenName=*)))

Include only the accounts that are part of the “sales” organizational unit of crescent.com
(&(objectCategory=Person)(objectClass=User)(memberof:1.2.840.113556.1.4.1941:=(CN=Authenticated Users,OU=sales,DC=crescent,DC=com)))

Include groups and exclude disable accounts with no First Name, Last Name, E-mail address:
(|(objectCategory=group)(&(objectCategory=Person)(objectClass=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(sn=*)(givenName=*)(mail=*)))

All user objects except ‘SAM’
&(objectCategory=person)(objectClass=user)(!(cn=SAM))

All objects with a surname that starts with ‘sa’
&(objectCategory=person)(objectClass=user)(sn=sa*)

All contacts with a surname equal to ‘Smith’ or ‘Jones’
(&(objectCategory=person)(objectClass=Contact)(|(sn=Smith)(sn=Jones))) 

Objects (Groups) with the name ‘DL-786’ or ‘DL-000005368’:
(&(objectCategory=group)|(name=DL-786*)(name=DL-000005368*)) –

SharePoint user profile exclusion filter: e.g. Exclude accounts that don’t have First name:
(&(objectCategory=Person)(objectClass=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(!givenName=*)))

Tips: You can write your own filters based on AD fields by looking them from an LDAP Browser/ADSI Edit console.

Links:

• Configuring user profile sync: Configuring My Sites & User Profile Synchronization in SharePoint 2010 – Step by step
• Search filters: https://msdn.microsoft.com/en-us/library/aa746475.aspx