[Fedora-directory-users] Winsync and "New Windows User Sync" and "New Windows Group Sync"

[Ivan Ferreira]

I found the problem.

I was delegating the administration of the replicated OU in Windows 20003.
This is not enough to enable "DirSync". The Windows replication Account
must have "Replicating Directory Changes" permissions.

Directory Server documentation
========================
During normal operation, all the updates made to entries in the Directory
Server that need to be sent to the Windows Server are generated via the
changelog. However, when the server is initially configured or after major
changes to its content, it is necessary to initiate a re-synchronization
process. For re-synchronization, the entire contents of synchronized
subtree in the Directory Server is examined and, if necessary, sent to the
Windows Server. This is done without using the changelog. Inbound changes,
that is changes to entries in the Windows Server, are found by using Active
Directory's `Dirsync' search feature. Because there is no changelog to use,
it is necessary to issue the Dirsync search periodically. The default
interval is five minutes.

Microsoft documentation
==================

Although the DirSync control is powerful and efficient, it has two
limitations. The first limitation is that the control must run by using a
user account that has the Replicating Directory Changes permission on the
domain naming context. By default, the Administrator user account has this
permission. However, we do not recommend that you use the Administrator
account to run your DirSync control program. Instead, we recommend that the
Replicating Directory Changes permission be granted to a typical user
account or group. Therefore, you can configure permissions that are
specific and limited to the DirSync control program.


http://support.microsoft.com/?scid=kb%3Ben-us%3B891995&x=16&y=16

========================================================================================
AVISO LEGAL: Esta información es privada y confidencial y está dirigida
únicamente a su destinatario. Si usted no es el destinatario original de
este mensaje y por este medio pudo  acceder a dicha información por favor
elimine el mensaje. La distribución o copia de este mensaje está
estrictamente prohibida. Esta comunicación es sólo para  propósitos de
información y no debe ser considerada como propuesta, aceptación ni como
una declaración de voluntad oficial de NUCLEO S.A.  La transmisión de
e-mails no garantiza que el correo electrónico sea seguro o libre de error.
Por consiguiente, no manifestamos que esta información sea completa o
precisa.  Toda información está sujeta a alterarse sin previo aviso.

This information is private and confidential and intended for the recipient
only. If you are not the intended recipient of this message you are hereby
notified that any review,  dissemination, distribution or copying of this
message is strictly prohibited. This communication is for information
purposes only and shall not be regarded neither as a proposal,  acceptance
nor as a statement of will or official statement from NUCLEO S.A. . Email
transmission cannot be guaranteed to be secure or error-free. Therefore,
we do not represent that this information is complete or accurate and it
should not be relied upon as such. All information is subject to change
without notice.