You will notice in your K2 Identity.Identity table, that some of your users are disabled, even though they are active in your Active Directory. For example, you may also see the following errors in your Hostserver logs:
"64007 Provider did not return a result for K2:'Domain'\'User' on GetUser","anonymous","0.0.0.0"
This is a known issue and a feature has been added into K2 4.7 to optimise the way K2 and Active Directory communicate.
The setting is used to determine how to translate DistinguishedNames to sAMAccountNames, via native LSASS or Managed Directory Entry binds, the latter being less security restrictions prone.
To enable this setting, please contact K2 Support to enable the "TranslateWithDirectoryServices" functionality.