This one's a little odd and may be outside the scope of LFDS, but figure it's worth asking. We're using AD synchronization to license users. I've noticed that sometimes after they leave the company their account in LFDS gets disabled, while other times it remains enabled but unlicensed. I would like all of them to be disabled.

So what's the difference? The user's accounts do get disabled in AD, but upon investigation it seems that those that get disabled within LFDS are still members of the groups associated with the synchronization rules. The accounts that remain enabled, albeit unlicensed, have been removed from the relevant licensing group (or more accurately, they got removed from all their AD groups as part of the offboarding procedure).

My question, then, is if there's a way to ensure these users that are disabled but removed from their groups also get disabled in LFDS? My guess is that since they're no longer part of the syncing group their off LFDS' radar and there won't be much it can do, but figure it's worth asking.

FWIW, this is with LFDS 10.4.5