Consider the following scenario:

Tom Fubar has two accounts on different Active Directories. tom.fubar@DOM1 and tom.fubar@DOM2

An internal application using Crowd for its authentication is set to use these directories, with DOM1 above DOM2 in the priority list.

If Tom's account is disabled on DOM1, but not DOM2, and Tom tries to log in to the application with his DOM2 credentials, Crowd will record an authentication failure against DOM1 and immediately fail the attempt, not even trying DOM2. Furthermore, the disabled user state is not checked before trying to validate the password, causing the BadPasswordCount to be incremented.

Ideally, Crowd could be configured to see that the account is disabled, not bother trying to auth against it, and try the next directory in the list.

A workaround for this is to configure the Crowd user filter for DOM1 to hide accounts that are disabled; this can be accomplished by including:

 (!(userAccountControl:1.2.840.113556.1.4.803:=2)) 

..somewhere in the user filter in Crowd, but this may not be appropriate for all use cases.