Check the bit for disabled Active Directory users. The filter is based
on http://ctogonewild.com/2009/09/03/bitmask-searches-in-ldap/ .