[otrs] LDAP: only "users" and no others, how to filter?

Hello list. I'd like to have OTRS filtering *only* our real Users from AD, therefore I did this one: AlwaysFilter => '(objectcategory=CN=Person,CN=Schema,CN=Configuration,DC=provincia,DC=verbania,DC=it)', This is OK, no groups are selected and no computer accounts, too. Now I'd like still to refine the filter, so that disabled/inactive/expired users *don't* get shown. How may I do this? And I also would like to avoid catching "system users" like "IUSR" and so on. Any clues? Thanks, -- ---------------------------------- Boniforti Flavio Provincia del Verbano-Cusio-Ossola Ufficio Informatica Tecnoparco del Lago Maggiore Via dell'Industria, 25 28924 Verbania ----------------------------------