Incomplete AD sync



We have setup Univention to sync with an existing AD environment.

It has successfully synced the OUs, devices and groups.

However, it has only synced 28 users, and there doesn’t seem to be any pattern. We’re expecting a few hundred.
For any given OU, it may have synced none, some or all users contained.
In some cases it has synced a user buried in a sub-OU, and yet none of the users in parent OUs.

I have installed and setup a 2nd Univention VM just in case something went wrong the first time, but the 2nd exhibits the same issue as the 1st.

Is there an obvious solution to this issue, or steps to trace, identify and resolve this AD sync issue?