We received a hint from our colleagues, who administrate the Active Directory, that we can exclude user objects, which have the value 2048 in the attribute userAccountControl.

We have done first tests with our own schema class - in our opinion this worked…