I need to be able to exclude users from the import from AD that have an account that is expired BUT not disabled.

We currently filter like this

   Attribute            Operator    Filter                                                                                          
   userAccountControl   Bit on equals   2

So any account that is disabled is not imported. But we have the situation where we need to exclude accounts that have expired that maybe enabled still.


If you are talking about the Passowrd expiray then their is filter for it.

  • userAccountControl Bit on equals 24 OR
  • userAccountControl Bit on equals 5 OR ( this is for the Locked account)

But another way is.

  • Create another OU and move all expired account into that OU then exclude that from the Import.


Also check this one How to exclude expired users from AD sync?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.