NT passwords can be synchronized to the directory only if a change is made to the password. If any NT user accounts exist when you first install the synchronization service, then the passwords for those user accounts can not be synchronized until they are changed. This is because the synchronization service cannot determine what a user's password is once it has been encrypted and stored in the NT domain.

Once the synchronization service has been installed, the machine rebooted, and NT-to-Directory Server password synchronization enabled, changed passwords are captured even if the synchronization service is not running. If the synchronization service is running, the passwords are sent to the directory server at the next scheduled or manually-initiated synchronization.

If you are using replication in your directory service, make sure that the directory server that you synchronize with is a supplier server; do not synchronize with a consumer server.

If you leave this field blank, the synchronization service will not enforce UID uniqueness. This is acceptable so long as the directory server itself is enforcing UID uniqueness. It does this through a server plug-in which is turned on by default.

Changing the start time does not cause the synchronization tool to wait for that time to begin synchronization; this field is used only for calculating the next synchronization event. For example, suppose the Start at field is currently set to 1:00 and the Synchronize every field is set to 15 minutes. If the current time is 2:20, then the next synchronization is scheduled for 2:30. Now suppose you change the Start at field to 1:40. Then synchronization will occur at 1:40, 1:55, 2:10, 2:25, and so forth. Therefore, the next synchronization will occur at 2:25 rather than the original 2:30.

The safest algorithm is also the default—the NT user name is used. This is the safest method of mail address creation because the NT user name must be unique within the NT domain managed by the local PDC.