[Freeipa-users] ipa-winsync account disable

[Attila Bogár]

Dear List,

winsync is working between AD and FreeIPA.

If I disable a user in FreeIPA, it automatically disables on the AD side.
Though, if I disable on the AD side, nothing happens on the FreeIPA side.

Moreover, if I get a kerberos ticket for the disabled (only in AD) user 
from freeipa, then it automatically enables the user on the AD side.

Settings for ipa-winsync are:
# ipa-winsync, plugins, config
dn: cn=ipa-winsync,cn=plugins,cn=config
ipawinsyncacctdisable: both

Is this the expected behaviour?

Thanks,
   Attila