Correct, Also check out Michael Bollhoefer's response he just made wherehe provides an LDAP filter to filter out the disabled accounts