If you are deleting or disabling a user from AD the user is not completely deleted from the Cryptzone/SEP database. This is to make sure that an old user that comes back still should have access to their encryption keys.
If you deleted a user from AD and another user with the same username is added to your AD there will be a conflict stopping the newly added user to be imported to the SEP database. Since the user doesn't exist the SEP Client will fail to sync with the SEP Server.
The user will not be listed in the SEP MC in the standard view and in the error logs you will find the following log entry:
Sources.Synchronization.SynchronizationJobDbHandler> User conflict! Ex Msg: User could not be added: A User with same login already exists in database
You will need to delete the user manually from the SEP MC by enabling visibility of inactive users and follow these steps.
Show inactive users
To show inactive users, open SEP Management Console, goto Enterprise manager, go to the filter button, select status, and tick Inactive
This will display inactive users as well. Please note the difference in icons between active and inactive users. Inactive users has a "greyed out" icon.
To delete the user - right click on the disabled user and choose delete.
Resync the AD and the user is now added and the SEP Client should sync without issues.