Unable to remove userphotos from users/mailboxes in Exchange 2013

Question

I'm trying to remove user photos from all users/mailboxes in Exchange 2013. Documentation is hard to find, most of the documentation seems to refer to previous versions of Exchange, and the methods used there no longer seem to work.

• We're using Exchange 2013 with CU2 installed, and Outlook 2010 with SP1 in online mode.
• Replication between the Domain Controllers (2x Server 2012 and one Server 2008 R2) is working correctly (checked with dcdiag /e /v).
• Domain and Forest functional levels are at 2008 R2.

I have tried running the following PowerShell commands:

Get-MailboxDatabase | Get-Mailbox | Set-Mailbox -RemovePicture
Update-GlobalAddressList -Identity "Default Global Address List"
Update-OfflineAddressBook -Identity "Default Offline Address Book"

This removed the photo's from the AD-attributes 'photoThumbnail' (checked it using the Attribute Editor in ADUC - the command Get-Mailbox *username* | fl name,hasPicture did return the value False), however the photo's are still present when I check in Outlook or WebApp.

I also tried using the following commands (this supposedly is the current method as of 2013):

Remove-UserPhoto "<name of user>"
Update-GlobalAddressList -Identity "Default Global Address List"
Update-OfflineAddressBook -Identity "Default Offline Address Book"

But this also seems to have had no effect.

I'm currently at a loss as to what more I can do to actually get rid of the photos and am considering resorting to a nasty cop-out (setting all user photo's to a white/grey silhouette-photo).

Solution

This is actually an attribute in the user object in Active Directory, not a mailbox attribute. (I know they say you can use the code you quoted to remove the picture, but I've never had it work either).

The easiest way I've found to delete it is to use ADSIedit, and clear the value stored for the attribute, like in the screenclip below.

Alternately, using PowerShell, you can use the Set-ADObject cmdlet, but you need the full LDAP location (distinguished name) of the user.

So, if you had a user John Smith, with a username of jsmith, in an OU named employees, in the domain.com domain, you'd use:

Set-ADObject 'LDAP://cn=jsmith,ou=employees,dc=domain,dc=com' -clear thumbnailPhoto

Comments

[Joseph Kern]

Wow. AD is used for everything now ...