16.8. Configuring Multiple Subtrees and Filters in Windows Synchronization

Windows Synchronization is designed to synchronize between multiple pairs of subtrees on the Directory Server (DS) and Active Directory (AD). By using filters, only specified entries under a subtree are synchronized.

Multiple Subtrees in Windows Synchronization

To synchronize among multiple subtree pairs, configure the Directory Server and the Active Directory subtrees in the winSyncSubtreePair parameter in the Windows sync agreement. Use ldapmodify to set multiple subtrees as follows: 
changetype: modify
add: winSyncSubtreePair
winSyncSubtreePair: ou=OU1,dc=DSexample,dc=com:ou=OU1,DC=ADexample,DC=com
If winSyncSubtreePair is not set, the nsds7WindowsReplicaSubtree AD subtree parameter and the nsds7DirectoryReplicaSubtree DS subtree parameter are used for the synchronization target checks instead. Otherwise, these two parameters are ignored.

Filters in Windows Synchronization

You can set a filter that selects data to be synchronized in the following parameters:
  • winSyncWindowsFilter sets an additional filter on the Active Directory server,
  • winSyncDirectoryFilter parameter sets an additional filter on the Directory Server.
In the following example, ldapmodify is used to synchronize entries whose CN contains user or group: 
changetype: modify
add: winSyncWindowsFilter
winSyncWindowsFilter: (|(cn=*user*)(cn=*group*))
-
add: winSyncDirectoryFilter
winSyncDirectoryFilter: (|(uid=*user*)(cn=*group*))