在 SharePoint Server 中维护用户配置文件同步设置Maintain user profile synchronization settings in SharePoint Server

适用范围: yes2013 yes2016 yes2019 无SharePoint OnlineAPPLIES TO: yes2013 yes2016 yes2019 noSharePoint Online

SharePoint Server 中的配置文件同步使 User Profile service 实例的管理员能够将存储在 SharePoint Server 配置文件存储中的用户和组配置文件信息与存储在中的配置文件信息进行同步整个企业中的目录服务。Profile synchronization in SharePoint Server enables an administrator of an instance of the User Profile service to synchronize user and group profile information that is stored in the SharePoint Server profile store with profile information that is stored in directory services across the enterprise. 配置完配置文件同步后,必须完成某些任务才能保留这些设置。After you have configured User Profile synchronization, you must complete tasks to maintain those settings. 这些任务包括:移除其帐户已禁用或已删除的用户,移动或重命名服务器,以及启动或停止用户配置文件同步服务等。These tasks include, for example, removing users whose accounts are disabled or deleted, moving or renaming a server, and starting or stopping the User Profile Synchronization service. 有关详细信息,请参阅为 SharePoint Server 2013 规划配置文件同步For more information, see Plan profile synchronization for SharePoint Server 2013.

若要在本文中运行 PowerShell cmdlet,请验证您是否具有以下成员身份:To run the PowerShell cmdlets in this article, verify that you have the following memberships:

  • SQL Server 实例上的 securityadmin 固定服务器角色。securityadmin fixed server role on the SQL Server instance.

  • 要更新的所有数据库上的 db_owner 固定数据库角色。db_owner fixed database role on all databases that are to be updated.

  • 运行 PowerShell cmdlet 的服务器上的 Administrators 组。Administrators group on the server on which you are running the PowerShell cmdlets.

重要

每个部分都注明它所应用于的 SharePoint Server 的版本。Each section is noted as to the version of SharePoint Server it applies to.

重命名用户或更改用户域Rename users or change user domains

备注

此部分适用于 SharePoint Server 2013、2016和2019。This section applies to SharePoint Server 2013, 2016, and 2019.

SharePoint Server 允许您处理几种不同的用户迁移方案。SharePoint Server lets you handle several different user migration scenarios. 下面是针对 Active Directory 域服务 (AD DS) 处理的方案的示例:The following are examples of the scenarios handled for Active Directory Domain Services (AD DS):

  • 帐户名 ( sAMAccountName) 在用户所在的 AD DS 中发生更改。Account name ( sAMAccountName) changes in the AD DS where the user exists.

  • 安全标识符 (SID) 发生更改。Security Identifier (SID) changes.

  • 可分辨名称 (DN) 发生更改,其中包括用户帐户所在的 AD DS 的组织单位 (OU) 容器中的更改。例如,如果用户的可分辨名称在 AD DS 中从"User= EUROPE\John Smith, Manager=CN=John Rodman, OU=Users, DC=EMEA1, DC=corp, DC=contoso, DC=com"移到"User= EUROPE\John Smith, Manager=CN=John Rodman, OU=Managers, DC=EMEA1, DC=corp, DC=contoso,DC=com", MigrateUser 命令将会更新该用户的用户配置文件存储。在将用户配置文件从 EMEA1.corp.contoso.com AD DS 同步到 SharePoint Server 用户配置文件存储时,John Smith 的用户配置文件将会得到更新。Distinguished name (DN) changes that include changes in the organizational unit (OU) container in the AD DS where the user account exists. For example, if a user's distinguished name is moved in AD DS from "User= EUROPE\John Smith, Manager=CN=John Rodman, OU=Users, DC=EMEA1, DC=corp, DC=contoso, DC=com" to "User= EUROPE\John Smith, Manager=CN=John Rodman, OU=Managers, DC=EMEA1, DC=corp, DC=contoso,DC=com", the MigrateUser command updates the user profile store for this user. The user profile for John Smith is updated when synchronizing user profiles from the EMEA1.corp.contoso.com AD DS to the SharePoint Server user profile store.

重命名用户或更改用户域To rename users or to change user domains

  1. 确认执行此过程的用户帐户拥有以下凭据:Verify that the user account that is performing this procedure has the following credentials:
  • 执行此过程的用户帐户是运行 SharePoint 管理中心网站 的计算机上 服务器场管理员 组的成员。The user account that performs this procedure is a member of the Farm Administrators group on the computer that is running the SharePoint Central Administration website.

  • 执行此过程的用户帐户是在其上安装了用户配置文件同步服务的计算机上的 管理员 组的成员。The user account that performs this procedure is a member of the Administrators group on the computer on which you installed the User Profile synchronization service.

  1. 如果同步正在进行,请打开管理中心,然后单击"应用程序管理"部分的"管理服务应用程序"。从服务应用程序列表中选择适当的 User Profile Service 应用程序。在"管理服务应用程序"页上,单击"停止配置文件同步"。If synchronization is in progress, open Central Administration and then click Manage service applications in the Application Management section. Select the appropriate User Profile service application from the list of service applications. On the Manage service application page, click Stop Profile Synchronization.

  2. 禁用用户配置文件增量同步计时器作业。Disable the User Profile Incremental Synchronization timer job.

  3. 确保使用 stsadm -o migrateuser 进行的用户迁移已成功完成。Ensure that user migration by using stsadm -o migrateuser has succeeded.

备注

SPUser也可用于迁移用户。Move-SPUser can also be used to migrate users.

  1. 通过浏览到已迁移用户的"我的网站"(例如 http://mysite/person.aspx?accountname=<new account name>)确保可以访问该用户的配置文件。Ensure that the profile of the migrated user can be accessed by browsing to the My Site for that user, for example, http://mysite/person.aspx?accountname=<new account name>.

  2. 运行用户配置文件同步。Run User Profile synchronization. 有关详细信息,请参阅在 SharePoint Server 中手动启动配置文件同步For more information, seeStart profile synchronization manually in SharePoint Server.

  3. 通过浏览到已迁移用户的"我的网站"再次检查该用户的配置文件的访问权限。Recheck access to the profile of the migrated user by browsing to the My Site for that user.

  4. 启用用户配置文件增量同步计时器作业。Enable the User Profile Incremental Synchronization timer job.

排除其帐户被禁用的用户Exclude users whose accounts are disabled

备注

此部分适用于 SharePoint Server 2013。This section applies to SharePoint Server 2013.

您可以使用 SharePoint Server 2013 中的排除筛选器来排除其帐户在 AD DS 中已禁用的用户。有关排除其帐户被禁用的用户所需的步骤,请参阅在 SharePoint Server 2013 中同步用户和组配置文件You can exclude users whose accounts are disabled in AD DS by using exclusion filters in SharePoint Server 2013. For the steps that are needed to exclude users whose accounts are disabled, see Synchronize user and group profiles in SharePoint Server 2013.

删除过时的用户和组Remove obsolete users and groups

备注

此部分适用于 SharePoint Server 2013、2016和2019。This section applies to SharePoint Server 2013, 2016, and 2019.

SharePoint Server 用户配置文件存储中可能存在过时的用户或组的原因有两个:There are two reasons why obsolete users or groups can exist in the SharePoint Server user profile store:

  • 过时的用户:"我的网站"清理计时器作业处于不活动状态。用户配置文件同步计时器作业将已经从目录源中删除的用户标记为待删除。当"我的网站"清理作业运行时,它会查找所有标记为待删除的用户并删除这些用户的配置文件。然后将各自的"我的网站"分配给已删除用户的经理,并向该经理发送一封电子邮件通知此删除情况。Obsolete users: The My Site cleanup timer job is not active. The User Profile Synchronization timer job marks for deletion users who have been deleted from the directory source. When the My Site cleanup job runs, it looks for all users marked for deletion and deletes their profiles. Respective My Sites are then assigned to the manager for the deleted user and an e-mail message notifies the manager of this deletion.

  • 过时的用户和组:用户配置文件存储中存在不是由配置文件同步导入的用户和组。Obsolete users and groups: Users and groups that were not imported by Profile Synchronization exist in the user profile store. 例如,如果从 SharePoint Server 的早期版本升级,并选择仅将域的子集与 SharePoint Server 同步,则会发生这种情况。This can occur, for example, if you upgraded from an earlier version of SharePoint Server and chose to only synchronize a subset of domains with SharePoint Server.

使用 PowerShell 查找和删除过时的用户和组To find and remove obsolete users and groups by using PowerShell

  1. 确认您具有以下成员身份:Verify that you have the following memberships:
  • ImportExport_GetNonimportedObjectsImportExport_PurgeNonimportedObjects 的执行权限将过程存储在配置文件数据库中。Execute permission on the ImportExport_GetNonimportedObjects and the ImportExport_PurgeNonimportedObjects stored procedures in the profile database.
  1. 启动 SharePoint 命令行管理程序。Start the SharePoint Management Shell.

  2. 在 PowerShell 命令提示符处,执行以下操作:At the PowerShell command prompt, do the following:

  3. 若要获取 User Profile Service 应用程序对象,请键入以下命令:To get the User Profile Service application object, type the following command:

$upa = Get-spserviceapplication <identity>
<span data-ttu-id="b4b66-159">其中  _\<identity\>_ 是用户配置文件同步服务应用程序的 GUID。</span><span class="sxs-lookup"><span data-stu-id="b4b66-159">Where  _\<identity\>_ is the GUID of the User Profile synchronization service application.</span></span> 
  1. 若要查看要删除的用户和组,请键入以下命令:To view the users and groups to delete, type the following command:
Set-SPProfileServiceApplication $upa -GetNonImportedObjects $true
  1. 若要删除过时的用户和组,请键入以下命令:To delete the obsolete users and groups, type the following command:

    注意

    此操作无法撤消。This action cannot be undone.

Set-SPProfileServiceApplication $upa -PurgeNonImportedObjects $true

有关详细信息,请参阅 Get-SPServiceApplicationSet-SPProfileServiceApplicationFor more information, see Get-SPServiceApplication and Set-SPProfileServiceApplication.

维护配置文件架构更改Maintain profile schema changes

备注

此部分适用于 SharePoint Server 2013。This section applies to SharePoint Server 2013.

配置文件架构更改包括添加新的用户配置文件属性,更改用户配置文件属性映射,或更改配置文件同步连接筛选器等内容。Profile schema changes include things such as adding a new user profile property, changing a user profile property mapping, or changing a Profile Synchronization connection filter. 当配置文件架构发生更改时,必须首先执行非定期完全同步,然后再安排定期配置文件同步。When the profile schema changes, you must first perform a full nonrecurring synchronization before scheduling recurring profile synchronization. 有关执行完全非周期性配置文件同步所需的步骤,请参阅在 SharePoint Server 中手动启动配置文件同步For the steps that are needed to perform full nonrecurring profile synchronization, seeStart profile synchronization manually in SharePoint Server.

重命名运行用户配置文件同步服务的服务器Rename a server that is running the User Profile synchronization service

备注

此部分适用于 SharePoint Server 2013。This section applies to SharePoint Server 2013.

使用以下过程重命名配置文件同步服务器。Use the following procedure to rename a profile synchronization server.

使用 PowerShell 重命名运行用户配置文件同步服务的服务器To rename a server that is running the User Profile synchronization service by using PowerShell

  1. 启动 SharePoint 命令行管理程序。Start the SharePoint Management Shell.

  2. 在 PowerShell 命令提示符处,键入以下命令:At the PowerShell command prompt, type the following command:

Rename-SPServer <Identity> -Name <newName>
<span data-ttu-id="b4b66-177">其中:</span><span class="sxs-lookup"><span data-stu-id="b4b66-177">Where:</span></span>
  • Identity 是服务器的旧名称。Identity is the old name of the server.

  • newName 是服务器的新名称。newName is the new name for the server.

有关使用 Microsoft PowerShell 重命名服务器的详细信息,请参阅重命名-SPServerFor more information about renaming a server by using Microsoft PowerShell, see Rename-SPServer.

将用户配置文件同步服务移到新服务器Move the User Profile Synchronization service to a new server

备注

此部分适用于 SharePoint Server 2013。This section applies to SharePoint Server 2013.

使用以下过程将用户配置文件同步服务移到新服务器。Use the following procedure to move the User Profile Synchronization service to a new server.

使用管理中心将用户配置文件同步服务移到新服务器To move the User Profile Synchronization service to a new server by using Central Administration

  1. 确认执行此过程的用户帐户拥有以下凭据:Verify that the user account that is performing this procedure has the following credentials:
  • 执行此过程的用户帐户是运行 SharePoint 管理中心网站 的计算机上 服务器场管理员 组的成员。The user account that performs this procedure is a member of the Farm Administrators group on the computer that is running the SharePoint Central Administration website.

  • 执行此过程的用户帐户是在其上安装用户配置文件同步服务的计算机上的 管理员 组的成员。这是启动用户配置文件同步服务所需的。启动用户配置文件同步服务后,可以从 管理员 组删除服务器场帐户。The user account that performs this procedure is a member of the Administrators group on the computer on which you installed the User Profile synchronization service. This is required to start the User Profile Synchronization service. After the User Profile Synchronization service is started you can remove the farm account from the Administrators group.

  1. 在当前运行用户配置文件同步服务的服务器上,在 SharePoint 管理中心网站的"系统设置"部分,单击"管理服务器上的服务"。On the server that is currently running the User Profile synchronization service, on the SharePoint Central Administration website, in the System Settings section, click Manage services on Server.

  2. 在"用户配置文件同步服务"的旁边,单击"停止"以停止用户配置文件同步服务。Next to the User Profile Synchronization Service, click Stop to stop the User Profile Synchronization service.

  3. 在新的用户配置文件同步服务器上,在SharePoint 管理中心网站的"系统设置"部分,单击"管理服务器上的服务"。On the new User Profile synchronization server, on the SharePoint Central Administration website, in the System Settings section, click Manage services on Server.

  4. 在"用户配置文件同步服务"的旁边,单击"启动"以启动用户配置文件同步服务。Next to the User Profile Synchronization Service, click Start to start the User Profile synchronization service.

  5. 在新的用户配置文件同步服务器上,在SharePoint 管理中心网站的"应用程序管理"部分,单击"管理服务应用程序"。On the new User Profile synchronization server, on the SharePoint Central Administration website, in the Application Management section, click Manage service applications.

  6. 在"服务应用程序"页上,单击相应的 User Profile Service 应用程序名称对应的链接。On the Service Applications page, click the link for the name of the appropriate User Profile service application.

  7. 在"User Profile Service 应用程序"页上的"同步"部分,单击"启动配置文件同步"。On the User Profile Service Application page, in the Synchronization section, click Start Profile Synchronization.

  8. 在“启动配置文件同步”**** 页上,选择“启动完全同步”****,然后单击“确定”****。On the Start Profile Synchronization page, select Start Full Synchronization, and then click OK.

将用户配置文件同步通信限制到特定域控制器Restrict User Profile synchronization communication to a specific domain controller

使用以下过程将配置文件同步通信限制到特定域控制器。Use the following procedure to restrict profile synchronization communication to a specific domain controller.

使用 Windows PowerShell 将用户配置文件同步通信限制到特定域控制器To restrict User Profile synchronization communication to a specific domain controller by using Windows PowerShell

  1. 启动 SharePoint 命令行管理程序。Start the SharePoint Management Shell.

  2. 若要获取 User Profile Service 应用程序对象,请键入以下命令:To get the User Profile service application object, type the following command:

$upa=Get-SPServiceApplication <GUID>
<span data-ttu-id="b4b66-205">其中  _\<GUID\>_ 是用户配置文件同步服务应用程序的 GUID。</span><span class="sxs-lookup"><span data-stu-id="b4b66-205">Where  _\<GUID\>_ is the GUID of the User Profile Synchronization Service application.</span></span> 
  1. 若要将配置文件同步通信限制到特定域控制器,请键入以下命令:To restrict profile synchronization communication to a specific domain controller, type the following command:
Set-SPProfileServiceApplication $upa -UseOnlyPreferredDomainControllers $true
> [!NOTE]
> <span data-ttu-id="b4b66-p111">可能需要 5 分钟的时间,更改后的属性值才能传播到 SharePoint 管理中心网站。在管理中心服务器上重置 IIS 会强制立即加载新值。若要详细了解如何重置 IIS,请参阅 [IIS Reset Activity](https://go.microsoft.com/fwlink/p/?LinkId=179336)(IIS 重置活动)。</span><span class="sxs-lookup"><span data-stu-id="b4b66-p111">It may take five minutes for the changed property value to propagate to the SharePoint Central Administration website. Resetting IIS on the Central Administration server will force the new value to be loaded immediately. For more information about resetting IIS, see [IIS Reset Activity](https://go.microsoft.com/fwlink/p/?LinkId=179336).</span></span> 

有关详细信息,请参阅 Get-SPServiceApplication 和 Set-SPProfileServiceApplication。For more information, see Get-SPServiceApplication and Set-SPProfileServiceApplication.

调整用户配置文件同步超时Adjust User Profile synchronization time-outs

备注

此部分适用于 SharePoint Server 2013。This section applies to SharePoint Server 2013.

以下情况中会出现超时:A time-out can occur on the following occasions:

  • 尝试在管理中心的"添加/编辑同步连接"页上连接到目录服务服务器时。When trying to connect to the directory service server on the Add/Edit a synchronization connection page in Central Administration.

  • 尝试在管理中心的"添加/编辑同步连接"页上填充容器列表时。当状态栏中出现 JavaScript 超时错误时,将会出现这种情况。When trying to populate the list of containers on the Add/Edit a synchronization connection page in Central Administration. This will occur as a JavaScript time-out error in the status bar.

  • 在管理中心的"添加/编辑同步连接"页上单击"确定"时。这将导致以下错误消息,并且出现这种情况的原因在于 Forefront Identity Manager Web 服务在创建或更新用户配置文件同步连接时出现超时:When clicking OK on the Add/Edit a synchronization connection page in Central Administration. This causes the following error message and occurs because of a time-out by the Forefront Identity Manager web service when creating or updating a User Profile synchronization connection:

"请求通道在 00:01:29.9062626 之后等待答复时超时。请增加传递给调用请求的超时值,或增加绑定上的 SendTimeout 值。分配给此操作的时间可能是某个较长超时值的一部分。""The request channel timed out while waiting for a reply after 00:01:29.9062626. Increase the timeout value passed to the call to Request or increase the SendTimeout value on the Binding. The time allocated to this operation may have been a part of a longer timeout."

使用 Windows PowerShell 调整用户配置文件同步超时的具体方法To adjust User Profile synchronization timeouts by using Windows PowerShell

  1. 如果要更改连接到目录服务器的超时值,请执行以下操作:If you want to change the time-out value for connecting to the directory server, do the following:

  2. 将以下代码粘贴到文本编辑器(如记事本)中:Paste the following code into a text editor, such as Notepad:

$upsAppProxy = Get-SPServiceApplicationProxy <UPSAppProxyGUID>
$upsAppProxy.LDAPConnectionTimeout = <NewTimeout>
$upsAppProxy.Update()
  1. 将_ <UPSAppProxyGUID> 替换为 User Profile service 应用程序代理和 <NewTimeout> _的 GUID,并以秒为单位的新超时值。Replace <UPSAppProxyGUID> with the GUID of the User Profile service application proxy and <NewTimeout> with the new time-out value in seconds. 默认超时值为 120 秒。The default time-out is 120 seconds.

  2. 将文件保存为扩展名为 .ps1 的 ANSI 编码文本文件。Save the file as an ANSI-encoded text file whose extension is .ps1.

  3. 如果要更改"填充容器"控件的超时值,请执行以下操作:If you want to change the time-out value for the Populate Containers control, do the following:

  4. 将以下代码粘贴到文本编辑器(如记事本)中:Paste the following code into a text editor, such as Notepad:

$upsAppProxy = Get-SPServiceApplicationProxy <UPSAppProxyGUID>
$upsAppProxy.ImportConnAsyncTimeout = <NewTimeout>
$upsAppProxy.Update()
  1. 如果要更改 Forefront Identity Manager Web 服务调用的超时值,请执行以下操作:If you want to change the time-out value for calls into the Forefront Identity Manager web service, do the following:

    将_ <UPSAppProxyGUID> 替换为 User Profile service 应用程序代理和 <NewTimeout> _的 GUID,并以秒为单位的新超时值。Replace <UPSAppProxyGUID> with the GUID of the User Profile service application proxy and <NewTimeout> with the new time-out value in seconds. 默认超时值为 1,000 秒(大约 17 分钟)。The default time-out is 1,000 seconds (approximately 17 minutes).

  2. 将以下代码粘贴到文本编辑器(如记事本)中:Paste the following code into a text editor, such as Notepad:

$upsApp = Get-SPServiceApplication 
<UPSAppGUID>
$upsApp.FIMWebClientTimeOut = 
<NewTimeout>
$upsApp.Update()
  1. 将_ <UPSAppGUID> 替换为 User Profile service 应用程序的 GUID 和 <具有> _新的超时值(以毫秒为单位)的 NewTimeout。Replace <UPSAppGUID> with the GUID of the User Profile service application and <NewTimeout> with the new time-out value in milliseconds. 默认超时值为 300,000 秒(大约 5 分钟)。The default time-out is 300,000 milliseconds (5 minutes).

  2. 将文件保存为扩展名为 .ps1 的 ANSI 编码文本文件,例如 AdjustProfileSyncTimeouts.ps1。Save the file as an ANSI-encoded text file whose extension is .ps1, such as AdjustProfileSyncTimeouts.ps1.

  3. 在"开始"菜单上,单击"所有程序"。On the Start menu, click All Programs.

  4. 单击"Microsoft SharePoint 2013 产品"。Click Microsoft SharePoint 2013 Products.

  5. 单击"SharePoint 2013 Management Shell"。Click SharePoint 2013 Management Shell.

  6. 转到保存该文件的目录。Change to the directory where you saved the file.

  7. 在 Microsoft PowerShell 命令提示符处,键入以下命令以执行脚本文件:At the Microsoft PowerShell command prompt, type the following command to execute a script file:

./<file name>.ps1
<span data-ttu-id="b4b66-243">其中, _\<file name\>_ 是要执行的文件的名称。</span><span class="sxs-lookup"><span data-stu-id="b4b66-243">Where  _\<file name\>_ is the name of the file to execute.</span></span> 

有关详细信息,请参阅 Get-SPServiceApplicationProxy 和 Get-SPServiceApplication。For more information, see Get-SPServiceApplicationProxy and Get-SPServiceApplication.