LDAP Query - ignore disabled users?

Hmm... I just did a dump of my account and of a disabled account.  I didn't see anything that indicated the account was disabled!  Here is the list of attributes it found.  THey all were basically the same between the two accounts.  Perhaps I should post this in the AD area?

whenCreated
userParameters (nothing obvious there)
objectCategory
badPwdCount
profilePath
codePage
scriptPath
objectGUID
adminCount
memberOf
instanceType
objectSid
badPasswordTime
dSCorePropagationData
company
objectClass
name
description
sn
initials
telephoneNumber
userAccountControl
primaryGroupID
lastLogon
accountExpires
lastLogoff
uSNChanged
lockoutTime
cn
msNPAllowDialin
title
logonCount
sAMAccountType
givenName
uSNCreated
displayName
userPrincipalName
pwdLastSet
whenChanged
department
countryCode
distinguishedName
logonHours
sAMAccountName

Might need to talk to the server admin who setup your AD and see if they can expose the disabled field to ldap.  

:-(  I am the server admin.  We are not AD experts here.  Perhaps I will post over in the AD area.

Quick question, so I can give you some points for the help.  Is there a way I can modify my query above to include both users and contacts?  I'm not sure how to convert "objectclass" to search multiple types.  Would I just repeat it in the filter?

Thanks

And is it possible to have this query cached like other queries?

Thanks.  That might be more than I need.  If there was a quick hit, I was going to do it.  The phone list is not accessed that often that it is an absolute requirement.

Crap...just tested it.  It doesn't return anything.

Well, I noticed that it should be contact not contacts.  I changed that, but it only returns the contacts and not the users.

Oops.  The exclamation mark should be a pipe:

filter="(&(|(objectclass=user)(objectclass=contacts))(telephoneNumber=*))"

:-)  That did it.  Doe the pipe signify an "or"?  I group the or's together with ( ) preceded by the pip and the and's together with the ( ) preceded with the &?

I'm basically trying to understand the syntax here.

Yes the pipe means "or", & means "and" and the exclamation mark means "not".  Here is some more info that may help you out:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ad/ad/creating_a_query_filter.asp

Not sure if its way too late, but the useraccountcontrol attribute will will tell you whether the account is active or not. A value of 512 is active, 514 is inactive & I think that 66048 means that the password never expires.

THat seems close.  In some testing, I see the following:

Active:  512, 66048
Inactive:  513, 66050

Do you know where I can find a list of these attribute values?

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adschema/adschema/a_useraccountcontrol.asp

Note that:
0x00000200 ==> Default Account Type = 512 in decimal
0x00000002 ==> Account is disabled    = 002 in decimal

So, for a default account type (user) that is disabled, the value would be 514. This is the case that I have in my domain.

Use this for check UserAccountControl bits:

(&(objectCategory=user)(!UserAccountControl:1.2.840.113556.1.4.803:=2))

Wow...what the heck is that long string?

The following filter worked for me:
filter="(&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"

The other example of:
(&(objectCategory=user)(!UserAccountControl:1.2.840.113556.1.4.803:=2))

did not work for me.