How to exclude expired users from AD sync?

Question

I am using sp 2010. I would like to exclude expired users from the AD sync connection. How can I implement this?

NOTE I mean Expired date and not Disabled.

Answer 1

You can add an LDAP filter in the synchronisation connection to exclude users based on the accountExpires attribute e.g.

(accountExpires>=127457662500870736)

You can generate the 64bit number using PowerShell. I generated the number in the example as follows:

 ((get-date).addyears(-10)).toFiletime()

Edit:

To add the filter edit your sync connection. Locate the user filter box and add the following filter:

(&(objectCategory=person)(objectClass=user)(accountExpires>=127457662500870736))

You can verify this returns the results you want from AD first by selecting find and then custom search and pasting in the above query.