I was presented with a challenge to find all of the users in SCCM that had been disabled in Active Directory. The key to this lies in this KB article: http://support.microsoft.com/kb/305144 From this we can see that a disabled account has a decimal value of 2. Problem is there's a lot of other values and they are cumulative. A little help from your favorite search engine, or a degree in advanced mathmatics, should show you that there's only two possible numbers that can mean an account is disabled. Those numbers are 514 and 66050.
To find all the users in SCCM that have been disabled in AD you would run this SQL query:
select Full_User_Name0 as 'User'
where user_account_control0 = '514' or
user_account_control0 = '66050'
order by Full_User_Name0
Matt Broadstock pointed out a much more elegant solution for this same issue. Here's his SQL:
SELECT TOP 100000 * from v_R_User SYS
WHERE ((POWER(2,1)) & SYS.User_Account_Control0) <> 0
ORDER BY SYS.User_Account_Control0