[389-users] (no subject)

[Theodotos Andreou]

Guys I' ve seen this warning on the 8.1 Administration Guide:

WARNING
There can only be a single sync agreement between the Directory Server
environment and the Active Directory environment. Multiple sync
agreements to the same Active Directory domain can create entry
conflicts. 

Ref:
http://www.redhat.com/docs/manuals/dir-server/8.1/admin/Windows_Sync.html

In my scenario I have many OUs under the AD synchronized subtree eg
ou=dep1,dc=example,dc=com , ou=dep2,dc=example,dc=com , etc. I tried to
synchronize the whole subtree dc=example,dc=com to the respective tree
on DS but this fails due to schema incompatibilities. So I created one
sync agreement per OU and it seems to be working as expected in my test
environment. What that warning above is all about? What could possibly
go wrong if you use multiple sync agreements. How can there be entry
conflicts if each synchronized subtree is different from the other?

Another issue I have is that when users are disabled on the AD they are
still active on the DS. An obvious workaround is to change the password
of the disabled user so he can not use his account on AD but it would be
nice if their is a solution to avoid this. Any ideas?