On Wednesday August 3 2005 9:46 am, David Boreham wrote: > >If I may be so bold as to take advantage of your knowledge and kindness - > > when I created the Windows Sync Agreement, I specified the DS subtree as > > ou=People,dc=headquarters,dc=mydomain,dc=com, and the Windows subtree as > > cn=People,dc=headquarters,dc=mydomain,dc=com. When the sync completed, > > all Windows users and groups ended up in the FDS People subtree. How > > would I get Windows groups to populate the FDS gorups subtree, and only > > users to populate the People subtree? > > In this current release it's not possible to do exactly what you want > (at least I can't think of an easy way to to it). The problem is that there > are two conventions for storing users vs. groups in the DIT: a) put > users and groups in the same container and b) put users in one > container and groups in a sibling container. You can deploy either > convention in both AD and FDS, but in order to have an easy life > in terms of Winsync, you need to use the _same_ convention on > both sides. Note that the fact that FDS has ou=People and ou=Groups > is simply a convention in the sample data loaded on request at install > time. You can easily adopt the same convention as is commonly used with AD: > put users and groups in the same container. (AD didn't exist when > we invented the ou=People, ou=Groups convention at Netscape way back). > > You _could_ defined two sync agreements : one to sync users and > the other to sync groups. Problem is that you would be pointing both > at the same subtree on the AD side and I believe that bad stuff would > happen as a result (there's no way to tell an agreement to only sync > groups, for example). Perfectly understood. Perhaps in suceeding versions ... My whole purpose in getting FDS, and in particular Winsync, working is so that I don't have to create users on my email server. Presently, I create a new user in ADS, then create that user on the mail server. As I may have mentioned earlier, I could use winbind, but I think I'd prefer ldap. So, my next step is to make Winsync/SSL work. Again, I believe I followed the Winsync section of the Admin manual exactly. The only section I didn't quite get - Configuring Windows Sync, Step2, which says to see the appropriate user documentation to configure SSL on Active Directory. I couldn't find any info anywhere (which, of course, could be my doing). Any ideas regarding getting Winsync/SSL to work. Thanks. Dimitri
