Miguel Angel Coa M. via FreeIPA-users wrote:

Hello Everyone, I've setting IPA server connect with AD (Windows Server 2012R2) and work fine, but i need change the sub-tree for user sync and this step fail (not sync anything) . For example, when i sync against the default base is ok

[.................] CN=Users,DC=example2,dc=com [.................]

[.................] nsds7WindowsReplicaSubtree: CN=Users,DC=example2,DC=com [.................]

But i try change the base and does not sync anything

[.................] CN=LAB,CN=Users,DC=example2,dc=com [.................]

When the LAB is AD group. ¿is possible sync against AD group?

IIRC winsync looks for entries that match objectclass=ntuser. I CN=LAB literally a group entry or a subtree?

rob