I asked my question here, but since thats not really my thread and allready awnserd I'm making my own http://social.technet.microsoft.com/Forums/en/ilm2/thread/326714af-9e6e-4821-8c24-3fad32ac7ce6 " I have an additional question to this, because I dont have time to try this out myself (deadline for presenting my Proof of Concept is soon). I have disable and enable account rules now, I did this with simply putting in 512/514 in useraccountcontrol (I realize this isnt the right way). Problem with this is once I disable someone, and then reenable them, it keeps flowing in that 512, enabling the account, even when it might be disabled bc of bad passwordcount or something like that. Would that be solved if I do it the propper way with the bitvalues ?" I thought that initial flow could also solve this, but it didnt seem to work and reading this: "The initial flow has nothing to with whether something should not be modified or not." in a different thread posted by markus it problbly doesnt

That would solve the problem. Markus has written a great post at here: http://social.technet.microsoft.com/wiki/contents/articles/using-fim-to-enable-or-disable-accounts-in-active-directory.aspx and you can find more about useraccountcontrol here http://support.microsoft.com/kb/305144