I'm using the new ldap sync feature introduced in one of the recent versions of GA services. The feature allows us to keep user in sync with active directory. The one thing I didn't like when I set this up was that if you did a sync to create users that don't already exist it would pull all of your disabled users and create home directories for them.

Here is how to stop that from happening:
Security->Login Methods
Click the edit button on the LDAP/AD profile your users are sync'd with:
Click the "User" tab
Edit the "Object Filter" to look like: (&(objectClass=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
--Brad

Brad,

Thank you for sharing this tip. This will work well for customers using Active Directory for authentication as part of a Managed LDAP Login Method. However, this object filter does not work with Active Directory Lightweight Directory Servers (AD LDS) based on our testing.

Thanks - Jon