TIP: How to LDAP deny disabled AD accounts

Question

Ironport LDAP queries will successfully lookup SMTP addresses of disabled AD accounts. For companies that disable accounts instead of deleting them, this can cause alot of junk mail to accumulate in the account's associated mailbox.
We currently move all disabled AD accounts to a DisabledAccounts OU.
By denying the AD user account used for lookups all rights to that specific OU and it's child objects, the Ironport now fails on lookups to that OU.
-Matt

Answer 1

Well... if I read the quoted MS article the value for a disabled user is 514
You can view and edit these attributes by using either the Ldp.exe tool or the Adsiedit.msc snap-in.
The following table lists possible flags that you can assign. You cannot set some of the values on a user or computer object because these values can be set or reset only by the directory service. Note that Ldp.exe shows the values in hexadecimal. Adsiedit.msc displays the values in decimal. The flags are cumulative. To disable a user's account, set the UserAccountControl attribute to 0x0202 (0x002 + 0x0200). In decimal, this is 514 (2 + 512).
This means that you must ask your LDAP filter to accept any value other than 514. (Or "must not be 514")
It might contain an error, I did not test it, but I think the LDAP filter
(& (|(mail={a}) (proxyAddresses=smtp:{a}) ) (!(userAccountControl=514)))
Would do the job... (At least my LDAP filter editor does not complain about syntax errors)
Steven