In several places in Chapter 10, we mention that you can use the 'msDs-User-Account-Control-Computed' attribute in place of the 'userAccountControl' attribute. That is mis-leading in some case and just wrong in others. Read more about the particular use of this attribute here:
http://dunnry.com/blog/msDsUserAccountControlComputedNotSoSpiffy.aspx
Ryan Dunn
Extemporaneous MumblingsThe .NET Developer's Guide to Directory Services Programming