In some cases accounts are disabled in Active Directory (AD). Either the user is on vacation, paternity leave or for other reasons.
In AD you inactivate a user by right clicking and selecting "disable account"
Next time SEP-server syncs to AD this user will not be visible by default, since SEP-server only shows active users.
To show inactive users, open SEP Management Console, goto Enterprise manager, go to the filter button, select status, and tick Inactive
This will display inactive users as well. Please note the difference in icons between active and inactive users. Inactive users has a "greyed out" icon.