cisco ucm: ldap filters
example filter:
(&(objectclass=user)(telephonenumber=*))
source: https://supportforums.cisco.com/document/112451/ldap-custom-filter-cucm-8x
update 8/15/2015:
the above filter works great. it will mark any ldap synced users without extensions as inactive (and for deletion later at night). it should proceed smoothly if your UCM service account users are properly set up as application users and if all of your ldap sync end users that need extensions assigned have them set already.