Currently the active directory integration only checks the account on the initial synchronization into Subsonic. After that, if the active directory account is disabled, the password changed, or the user removed from the user group with Subsonic permissions... Subsonic ignores these changes, as it only authenticates the user subsequently from it's own user cache instead of re-authenticating with the Active Directory server. This poses a security risk, as account changes from the Active Directory are not obeyed by Subsonic.
See: viewtopic.php?f=2&t=12312