APs going to controllers that have AP Fallback disabled- maddening

Question

Adding a new 8510 HA Pair to an existing large environment. The 8510s are up with management addresses, and AP fallback is disabled. Basically, these are controllers that are being configured as time allows and so need to be on the wire. Typically, disabling AP fallback is all that's needed to keep the APs away while working on a WLC. These 8510s have been sitting there for a week, and last night out of the blue one of them took on like 150 APs (is licensed for 1000) from a few different controllers in a very random feeling event. Since the APs hit a controller that wasn't properly configured, lots of clients were dead in the water. 
Did something change in 8.0.100 code or the 8510 that makes "AP fallback disabled" not effective? Is there any more positive way of keeping APs off of a controller that's a work in progress other than ACLs and putting them on different networks, etc? Seems reasonable to be able to just turn off  a controller's willingness to take APs...
Thoughts?
Lee

Answer 1

Hi Lee,
Typically, disabling AP fallback is all that's needed to keep the APs away while working on a WLC.
On which WLC you disable AP fallback. If it is on new 8510,it simply mean if AP (previosly registered to a different WLC as primary) fail over to new 8510 when primary WLC unavailable, then AP won't fallback to its primary controller even if Primary WLC came back.
http://mrncciew.com/2013/04/07/ap-failover/
Is there any more positive way of keeping APs off of a controller that's a work in progress other than ACLs and putting them on different networks, etc?
You can enable "Securiry->AP Policies->Authorize MIC APs against auth-list or AAA" on your  new 8510. In this way unless you add AP ethernet MAC address onto the auth-list, no AP will be able to register to your WLC.
HTH
Rasika
**** Pls rate all useful responses ****