Again, for completeness. It turns out that if you’re using LDAP, when the LDAP sync runs it re-activates any users who were deactivated. This, plus the fact that you can only migrate using the CLI makes Mattermost (Enterprise edition) largely unusable from our perspective. And you cannot “just” use LDAP for auth and not bother with sync. It seems that Mattermost feels that once you move to LDAP, LDAP should do all the driving. In an organisation with tens of thousands of users, only a tiny tiny portion of whom should be authorised to use Mattermost, we don’t see it that way at all. So I’ve set this to unsolved again. Such is life.