I solved this and I'll share my ignorance just in case it helps someone else: It wasn't clear to me that passsync needed the search base on the IPA server rather than the search base for the ad server. *facepalm* <div class="gmail_quote">---------- Forwarded message ---------- From: Nate Marks <<a href="mailto:npmarks@gmail.com">npmarks@gmail.com</a>> Date: Fri, Dec 21, 2012 at 9:47 AM Subject: passync LDAP error in queryusername To: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> 32: no such object deferring password change for newinclude I'm baffled. I think I made the search base exactly the same as the DN I found in LDP. Capitalized "OU" and DC. no spaces. the ad dn for the search base is 'OU=syncinclude,OU=syncroot,DC=testdomain,DC=corp' it detected the password change for 'CN=newinclude,OU=syncinclude,OU=syncroot,DC=testdomain,DC=corp' Any tips </div>