LDAP OU Definition containing "(userAccountControl:1.2.840.113556.1.4.803:=2)" could retrieve locked accounts beside inactive usersIssue Some customers would like to retrieve inactive accounts by importing them using our LDAP integration. However, on some LDAP, the userAccountControl:1.2.840.113556.1.4.803:=2 search will fetch both inactive and locked accounts. Inactive accounts are accounts disabled on the LDAP server. Locked accounts are accounts on which the password needs to be reset or too many incorrect passwords have happened, etc. In some cases, locked accounts are still active and users will unlock the accounts at some point. If you disable LDAP locked accounts on the instance, once they unlocked their accounts on their LDAP server, they will not be able to log in to the instance and your administrators might need to re-enable the account on the instance. Symptoms You will notice this problem if: You have an LDAP import to retrieve the inactive accountsYour inactive accounts are fetched using the LDAP OU Definition filter: (userAccountControl:1.2.840.113556.1.4.803:=2)Some active users report that their users can not log in to the instance and those users have recently had their accounts locked (e.g. too many password retries).Some users report their accounts have been set disabled while their LDAP account remains active.CauseThe LDAP server searching for (userAccountControl:1.2.840.113556.1.4.803:=2) retrieves inactive and locked accounts.ResolutionPlease educate your system administrators on the LDAP query containing userAccessControl could retrieve both inactive and locked users. To avoid importing locked accounts, please modify the filter to avoid the records where userAccountControl is 512* or 544*, or modify the LDAP import transformation map onBefore script to avoid disabling the required user. Note: userAccountControl is a cumulative attribute defined on the LDAP server itself as it controls the User account properties by masks. Please contact your LDAP administrator to validate if there is a better query to cover your business requirement.