diff --git a/samba-directory/self-service-passwords.yaml b/samba-directory/self-service-passwords.yaml
index b9db4b0..f26575b 100644
--- a/samba-directory/self-service-passwords.yaml
+++ b/samba-directory/self-service-passwords.yaml
@@ -15,6 +15,7 @@ data:
     /* Samba AD DC */
     $ldap_url = "ldaps://dc.undercloud.local:636";
     $ldap_binddn = "CN=lam,OU=serviceaccounts,OU=users,OU=Undercloud,DC=undercloud,DC=local";
+    $ldap_filter = "(&(objectClass=user)(sAMAccountName={login})(!(userAccountControl:1.2.840.113556.1.4.803:=2)))";
     $ldap_bindpw = getenv('LDAP_BINDPW');
     $ldap_base = "DC=undercloud,DC=local";