I have 389 DS working with Window Sync against Windows 2003. It works fine,
including the password replication. Anyway I found that (obviusly) the
password replication from 389 to AD works only if the client changes the
password using "Password Modify (RFC 3062) extended operation". This works
with the Python module or the ldappasswd utility.
The problem is the Admin Console. When you changes the user's password from
the console, I see a MOD operation in the log file, and obviusly the
password is not replicated to AD.
Shall I file a bug report or Am I missing something?