Thanks for your assistance Quanah! About the userPassword attributes... On Apache Directory Studio (we only normally use it as a quick visual reference)...but, we bind both servers as cn=ldapadmin,dc=example,dc=ldap & cn=admin,cn=config (plus now uid=replicator,ou=Admins,dc=example,dc=ldap). I just tested an ldapsearch by binding to the uid=replicator and the userPassword attribute returns when searching for it...though both are different from each other (verified with other users "jdoe2" and "jdoe3", etc)
If it is correct via ldapsearch, that is what counts. ADS may be attempting some security by hiding userPassword?
Supposedly, if I update one server, the other server should update, too. That is if they are properly talking. Correct?
And assuming your masters are in sync to start with, which is critical when thinking about replication. It would appear you've been allowing writes ops to each master prior to getting replication working?
I believe you mentioned before this is a test environment. I would suggest you reload your secondary master from the primary master, and then test replication.
--Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration