May be someone who supports Blueprint product will find it helpful.
When an employee leaves the company his ActiveDirectory's account is disabled, the card is sometimes given to other person and if the new owner swipes it over a reader, then there is no way for automatic registration as the card is still hold for no longer active but still valid Blueprint account.
So, the idea is to run nightly a procedure to unlink or rather to move the card to fake account of type 0=Employee.
Attached is all the code.
1. openLDAP is used to get disabled accounts of the last 3 days
2. joined with all the accounts\cards view to get a new table containing cardIDs to unlink and fake accounts [postfix _disabled]
3. powershell to get UTF csv out of the SQL