By mistake an editor created thousands of sitecore users that now need to me removed. Using the User Manager would take too long as it allows you to remove them one by one.

If deleting the users by SQL from the Core database directly, it is enough with deleting the user from the tables listed below or do I need to do something else?

  1. aspnet_Users

  2. aspnet_UserInRoles

  3. aspnet_Membership

  4. aspnet_PersonalizationPerUser

  5. aspnet_Profile

Is there any other method to remove them?

Note: This client uses Sitecore 6.6

  • 3
    Wouldn't be safer to use Sitecore API for that?. I would create aspx file or use Sitecore PowerShell Extensions and remove users using UserManager class instead. Commented Jun 2, 2017 at 8:40

2 Answers 2


Yes, basically.

SELECT UserID, UserName
into #temp
FROM aspnet_Users
WHERE UserName in

You should adjust this WHERE clause to catch the users you want, presumably on something like Created Date or so.


DELETE FROM dbo.aspnet_Membership WHERE UserId IN (Select UserId from #temp)
DELETE FROM dbo.aspnet_UsersInRoles WHERE UserId IN (Select UserId from #temp)
DELETE FROM dbo.aspnet_Profile WHERE UserId IN (Select UserId from #temp)
DELETE FROM dbo.aspnet_PersonalizationPerUser WHERE UserId IN (Select UserId from #temp)
DELETE FROM dbo.aspnet_Users WHERE UserId IN (Select UserId from #temp)

Source: Bulk Delete ASP.NET Membership Users

Make sure you flip the Sitecore AppPool when you're done, to prevent any user caching.

  • 1
    I think this is the correct answer, but still I prefer the suggestion from Alan to go through the Sitecore API... Commented Jun 2, 2017 at 9:43

Another way to do this would be from User Manager, by leveraging the serialization feature. For this to work, you need direct access to the server.

  1. Click on "Serialize All Users".
    serialize all button
  2. Go to your security serialization folder (by default: data/serialization/security). Users will be organized by domain. If all offending users are part of the same domain, it should be easy to delete them, either via GUI (Explorer) or command line. If you already have a list, you can turn it into a batch file where each line deletes one file (user).
    user files
  3. Cick on "Revert All Users".

You can't recover from this operation so make sure you first back up the Core database and/or the unmodified serialized users.

  • 3
    I think this would reset the password of all the users to "b" kb.sitecore.net/articles/242631 Commented Jun 2, 2017 at 14:35
  • Just tried it in Sitecore 6.6 and password and roles are preserved for users that are left untouched. Even if you change some details (e.g. email address), the password is not changed. It could be that the deserialization process compares hashes and doesn't make any update if they are the same.
    – maz
    Commented Jun 2, 2017 at 14:47
  • 1
    From the Sitecore Sitecore CMS 6.2.0 rev.100104 Release Notes: "When reverting serialized users, the password will no longer be reset to the default password for exisiting user account. The user account will simply be updated with the serialized information instead of being deleted first." - sdn.sitecore.net/Products/Sitecore%20V5/Sitecore%20CMS%206/…
    – maz
    Commented Jun 2, 2017 at 15:00
  • 2
    I just checked and you are right, in this scenario, passwords are not lost. Thanks for the update Commented Jun 2, 2017 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.