tfs2012 - TFS 2012 Orphan users -

over past 18 months, we've had 85 tfs users leave company. 8 persist show both [team foundation]\team foundation valid users & [collection]\project collection valid users although have no other project group memberships.

in our enterprise, tfs users identified ad/network id , "disabled" upon departure company policy rather being deleted. typically, left no group memberships outside of global group membership "domain users."

we use team foundation server 2012 update 3 in production. have begun testing in our test environment , plan move production update 4 within next 6 months.

we have continually expanded our criteria ensuring no "entanglements" exist disabled users prevent "orphaned user" situation. review , take action upon departure of tfs user ensure:

1.  user not associated tfs collection project group 2.  user has no workspaces associated identity in tfs 3.  user has no shelvesets associated identity in tfs 4 . user has no items checked out (locked) in tfs 5.  user has no work items “assigned to” identity in tfs 6.  user has no project alerts associated identity in tfs 

we have dropped users through either command-line or through web interface. ensure don’t show through administrator console. have cleared cache on tfs server. monitor tfssynchronizeidentities routinely , have seen operate correctly consistently. tfs server rebooted routinely.

the longest persistent "orphaned user" has continued under teamfoundation , collection valid users' groups 18 months while 77 other users have dropped little additional action required. problem persists. 8 "orphaned users" have occurred on entire 18 months - not old problem 8 persist 18 months ago , other 77 have been removed since point.

current testing results using update 4 indicate "orphaned users" persist across upgrade update 3 update 4. update 4 has not resolved problem of "orphaned users."

we had similiar issue tfs2013 update 4. users, have left company still existed in assigned dropdown list of team web access. setting "ninja like" registry key inside tfs configuration did trick us. heres code:

using microsoft.teamfoundation.client; using microsoft.teamfoundation.framework.client;  // tfsconfigurationserver var cs = new microsoft.teamfoundation.client.tfsconfigurationserver(new uri("http://yourtfs:yourport/tfs")); cs.ensureauthenticated(); // reg service of configuration server var regservice = cs.getservice<iteamfoundationregistry>(); //set value regservice.setvalue("/service/integration/settings/identitysyncfull", true); 

afterwards trigger new synchronization watch result.