I am using sp 2010. I would like to exclude expired users from the AD sync connection. How can I implement this?

NOTE I mean Expired date and not Disabled.

1 Answer 1


You can add an LDAP filter in the synchronisation connection to exclude users based on the accountExpires attribute e.g.


You can generate the 64bit number using PowerShell. I generated the number in the example as follows:



To add the filter edit your sync connection. Locate the user filter box and add the following filter:


You can verify this returns the results you want from AD first by selecting find and then custom search and pasting in the above query.

  • Dear Bunazb, thank you. How to do somethin like this?: (accountExpires >= currentDate)
    – Ola
    Nov 25, 2014 at 12:02
  • See my edit for more details.
    – Bunzab
    Nov 25, 2014 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.