David >Depending on how robust your identity management system is, you could add an attribute to users in LDAP2 that says "disabled in LDAP1", then modify the search >filter so that users that are in LDAP2 and disabled in LDAP are not found. That's a thought. I can see if I can work with that as well. Thanks, Lee