I have 389 DS working with Window Sync against Windows 2003. It works fine, including the password replication. Anyway I found that (obviusly) the password replication from 389 to AD works only if the client changes the password using "Password Modify (RFC 3062) extended operation". This works with the Python module or the ldappasswd utility.
The problem is the Admin Console. When you changes the user's password from the console, I see a MOD operation in the log file, and obviusly the password is not replicated to AD.
Shall I file a bug report or Am I missing something?