在 ADFS 服务器上运行以下 PowerShell 脚本将禁用或过期的本地 AD 帐户从第三方声明提供者信任中删除：

$ClaimsProviderTrustName = "ClaimsProviderTrustName"
$AccountSuffix = "@domain.com"

# Disable expired accounts
$expiredAccounts = Search-ADAccount -AccountExpired -UsersOnly | where { $_.UserPrincipalName.EndsWith($AccountSuffix)}
foreach ($account in $expiredAccounts) {
    Remove-ADFSRelyingPartyTrust -Name $ClaimsProviderTrustName -AccountPartner $account.UserPrincipalName
}

# Disable disabled accounts
$disabledAccounts = Search-ADAccount -AccountDisabled -UsersOnly | where { $_.UserPrincipalName.EndsWith($AccountSuffix)}
foreach ($account in $disabledAccounts) {
    Remove-ADFSRelyingPartyTrust -Name $ClaimsProviderTrustName -AccountPartner $account.UserPrincipalName
}

上述代码会自动查找过期或禁用的本地 AD 帐户，并将其从指定的第三方声明提供者信任中删除。请注意，您需要'ClaimsProviderTrustName”替换为正确的声明提供者信任的名称，并根据需要更改“AccountSuffix”。