I have been using 389 for a while and so far my replication strategy is:

389 <=> AD
 Replicating whole domain

dc=my,dc=domain
 - OU=user
   -user1
   -user2
 - OU=people
   -user1
   -user2
 - OU=apps
   -user1
   -user2
 - OU=externos
   -user1
   -user2
  ...

But this specific "OU=externos" does not exists on AD side (and I need to keep this).


My version in production is:
389-Directory/1.3.2.19 B2014.201.1231

And I have no problem on this scenario.


I'm testing newer versions of 389 (to update my production version) and I realized, maybe, that's not the better strategy. Why? Because 389 fails to start the full replication when the OU just exists on 389 side (https://pagure.io/389-ds-base/issue/48841).

So, can you give a clue what should I do when I need a specific OU to be outside of my replication?


Thanks.