I propose hiding users through the use of filtering in the membership provider.
Consider using the customFilter attribute used by the Active Directory membership and role providers. Examples shown below.
Active Directory supports the following filter for excluding disabled users:
You can find more details here on filters supported by Microsoft Active Directory; no guarantees that the AD module will recognize them all.
The customFilter attribute is documented in the AD module docs but there are not too many examples on how to do this in production.
I was able to get the filtering of disabled users working today. Thanks for the idea.
Use these filters in your web.config. Users which require access to Sitecore are added to the GRP-Sitecore-Users group in Active Directory. To keep things simple, this tracking group limits who appears in User Manager; the remaining access is configure in Sitecore on an individual user basis.
SitecoreADMembershipProvider Custom Filter:
SitecoreADRoleProvider Custom Filter:
A complete example demonstrating settings with the Active Directory module can be found here. The only part missing is the disabled filter.