Find disabled user in idm side or AD resource?

Question

Any disabled user is moved to disabled accounts OU in AD in our enviroment.
What is the best way to check for any disabled user in a workflow? is this on IDM side or in the disabled user's OU in AD?
If so, what would be the correct attribute to use.
Please suggest?
Thanks for your help.
Edited by: @waveset on Mar 3, 2008 1:10 PM
Edited by: @waveset on Mar 3, 2008 1:14 PM

Answer 1

i am trying to get this value at runtime in a form or rule
i am getting the user object as follows:
<defvar name='thisUserObj'/>
<setvar name='thisUserObj'>
     <invoke name='getObject'>
          <new class='com.waveset.server.InternalSession'/>
          <invoke name='findType' class='com.waveset.object.Type'>
               <s>User</s>
          </invoke>
          <ref>accountId</ref>
</invoke>
</setvar>
i SHOULD be able to reference the disabled attribute in any of the following ways, but they all return null:
<notnull>
     <select>
<invoke name='getAttribute'>
     <ref>thisUserObj</ref>
     <s>disabled</s>
</invoke>
<ref>thisUserObj.accounts[Lighthouse].disabled</ref>
<ref>thisUserObj.waveset.disabled</ref>
</select>
</notnull>
What am i doing wrong? Any help is appreciated.
Thanks