Disable user CLI

Anyone know what gets toggled in OD when you disable an account in WGM? I did an ldif export before and after, and diff'd the files, and there is no difference. So it must be setting something in PasswordServer. Any idea what? Can it be twiddled from the command line, or am I just going to be forced to set a keyword, then disable accounts in WGM after searching for that keyword? Thanks!