[otrs] LDAP: only "users" and no others, how to filter?

[Boniforti Flavio]

Hello list.
I'd like to have OTRS filtering *only* our real Users from AD, therefore 
I did this one:

             AlwaysFilter => 
'(objectcategory=CN=Person,CN=Schema,CN=Configuration,DC=provincia,DC=verbania,DC=it)',

This is OK, no groups are selected and no computer accounts, too.
Now I'd like still to refine the filter, so that 
disabled/inactive/expired users *don't* get shown. How may I do this?
And I also would like to avoid catching "system users" like "IUSR" and 
so on.

Any clues?

Thanks,
-- 
----------------------------------
Boniforti Flavio
Provincia del Verbano-Cusio-Ossola
Ufficio Informatica

Tecnoparco del Lago Maggiore
Via dell'Industria, 25
28924 Verbania
----------------------------------