It is not related to your problem, but considering your acl, the userpassword (and shadowlastchange) of the cn=sync user won't be replicated. If this behaviour is not intended, you should refer to the openldap admin guide http://www.openldap.org/doc/admin24/access-control.html

On the MAIN SERVER I HAVE 
access to attrs=userPassword,shadowLastChange
        by self =xw
        by anonymous auth
by dn="cn=sync,dc=my company,dc=com" read
        by * none 

--Quanah

--
Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra ::  the leader in open source messaging and collaboration