I have 389 DS working with Window Sync against Windows 2003.
It works fine, including the password replication. Anyway I
found that (obviusly) the password replication from 389 to AD
works only if the client changes the password using "Password
Modify (RFC 3062) extended operation". This works with the
Python module or the ldappasswd utility.
The problem is the Admin Console. When you changes the
user's password from the console, I see a MOD operation in the
log file, and obviusly the password is not replicated to AD.