Winsync require LDAPS for password sync. This domain user needs some privileges in ad - modifying, read, write on the synced subtree.

From ds point of view you configure normal user account for needs of sync with ad. This user doesn't need to be in your organization tree.  You can place him in cn=config. I usually create account like cn=adsyncuser, cn=config without ocjectclasses providing normal system account attributes.

Hope this helps you