During synchronization, the Service Manager locks the user account that it synchronizes. When the user account is locked, the Service Manager cannot authenticate the user account. Users might not be able to log in to application clients. If users are logged in to application clients when synchronization starts, the users might not be able to perform tasks. The duration of the synchronization process depends on the number of users and groups to be synchronized. To avoid usage disruption, synchronize the security domains during times when most users are not logged in.
To synchronize more than 100 users or groups, enable paging on the LDAP directory service before you run the synchronization. If you do not enable paging on the LDAP directory service, the synchronization can fail.