About Windows Sync

When creating the sync agreement, there is an option to synchronizing new Windows entries (nsDS7NewWinUserSync and nsDS7NewWinGroupSync) as they are created. If these attributes are set to on, then existing Windows users/groups are synchronized to the Directory Server, and users/groups as they are created are synchronized to the Directory Server.

Within the Windows subtree, only entries with user or group object classes can be synchronized to Directory Server.

On the Directory Server, only entries with the ntUser or ntGroup object classes and attributes can be synchronized.

See Section 3, “Using Windows Sync” for more information on creating user and group entries.

The placement of the sync agreement depends on what suffixes are synchronized; for a single suffix, the sync agreement is made for that suffix alone; for multiple suffixes, the sync agreement is made at a higher branch of the directory tree. To propagate Windows entries and updates throughout the Directory Server deployment, make the agreement between a master in a multi-master replication environment, and use that master to replicate the changes across the Directory Server deployment, as shown in Figure 19.2, “Multi-Master Directory Server - Windows Domain Synchronization”.

CAUTION

There can only be a single sync agreement between the Directory Server environment and the Active Directory environment. Multiple sync agreements to the same Active Directory domain can create entry conflicts.

517

Page 537
Image 537
HP UX Red Hat Direry Server Software manual About Windows Sync, 517