This error occurs if the user is disabled in AD, and when the group is resolved AD actually returns the user that is disabled in AD as a Member of this group so you will then enable the user in Identity cache again. After AD provided the Groups members it tries to get the properties of the users.  This is when the error is logged, as AD doesn’t provide the properties as the user is actually disabled (AD doesn’t stop Group member check if user is disabled).

Thus on the next user refresh or auto thread refresh the user will then be disabled in Identity Cache again.  The only other thing I can think of that the you can do is one of the following:

1) Ignore the error thrown as it is understood why it is thrown and it has no impact.

2) In AD goto the Users that are disabled and click Properties -> Member of.  Remove the Groups from there.  Not that by default Domain Users will be the users Primary Group and you will not be able to remove it. I suggest creating a new AD group called “Disabled Users” adding the disabled user to this group and mark it as the primary group and then you’ll be able to delete the Domain users group. Thus the disabled user is only now a member of the “Disabled Users” group.

3) Delete the Disabled users from AD.