To avoid contacts being created in servicedesk when pdm_ldap_import runs.
Now an 'ldap-disabled' user will not be imported into servicedesk.
After you 'enabled' the user in ldap, you need to run the pdm_ldap_import again to add that user into Service Desk.
How does this work?
The change in the ldap.mod file helps servicedesk to use the filter provided in the argument.
The ldap.mod file maps the userAccountControl variable as "!userAccountControl:1.2.840.1135188.8.131.523:".
So when we query ldap, the query string becomes !userAccountControl:1.2.840.1135184.108.40.2063:=2 which basically means a logical AND of userAccountControl and hex value 2 and finally a logical NOT.
A logical AND of userAccountControl (here the logical AND is performed by :1.2.840.1135220.127.116.113: appended to userAccountControl) gives a value of 2 if the user account is disabled.
Since we are doing a logical NOT of the value, we get only the active accounts, and NOT the disabled ones.
In short, when querying ldap, ldap returns only active users if we use !userAccountControl:1.2.840.113518.104.22.1683:=2 as argument. Thus all the inactive accounts are filtered out of the ldap results.