# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON    on

TLS_CACERTDIR   /etc/openldap/certs
ssl             start_tls
TLS_REQCERT     allow
BASE            dc=hq,dc=example,dc=com
URI             ldaps://newldap.hq.example.com
HOST            192.168.2.60

As an example of the slapd.conf file:
#######################################################################
# $Id: slapd.conf,v 1.5 2004/04/23 23:27:01 slothrop Exp $
#######################################################################
#
# Application:   OpenLDAP
# Server:        ldap1
# Filelocation:  /etc/openldap/slapd.conf
# Documentation: See slapd.conf(5) for details on configuration options
# Notes:
#######################################################################

# Default Hash
password-hash {SSHA}

# Schema
include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/samba.schema

include     /etc/openldap/schema/corba.schema
include     /etc/openldap/schema/duaconf.schema
include     /etc/openldap/schema/dyngroup.schema
include     /etc/openldap/schema/java.schema
include     /etc/openldap/schema/misc.schema
include     /etc/openldap/schema/openldap.schema
include     /etc/openldap/schema/collective.schema
include     /etc/openldap/schema/freeradius.schema
include     /etc/openldap/schema/freeradius-clients.schema
include     /etc/openldap/schema/ppolicy.schema

# Allow LDAPv2 client connections.  This is NOT the default.
#allow bind_v2

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.org

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

# Load dynamic backend modules:
 modulepath     /usr/lib64/openldap
# moduleload    back_bdb.la
# moduleload    back_ldap.la
# moduleload    back_ldbm.la
# moduleload    back_passwd.la
# moduleload    back_shell.la
  moduleload    memberof.la

# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by changing to
# /usr/share/ssl/certs, running "make slapd.pem", and fixing permissions on
# slapd.pem so that the ldap user or group can read it.  Your client software
# may balk at self-signed certificates, however.

TLSCACertificateFile /etc/openldap/cacert.pem
TLSCertificateFile /etc/openldap/server.crt
TLSCertificateKeyFile /etc/openldap/private.key

# Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

access to attrs=userPassword
   by self         write
   by anonymous    auth
   by dn="uid=syncuser,dc=hq,dc=example,dc=com"       read
   by *    compare
access to attrs=sambaLMPassword,sambaNTPassword
   by dn="uid=syncuser,dc=hq,dc=example,dc=com" read
   by * none
access to *
   by self write
   by * read

access to dn.subtree="dc=hq,dc=example,dc=com"
    by self write
    by set="[cn=itlevel1,ou=Groups,dc=hq,dc=example,dc=com]/member* & user" write
    by set="[cn=ntadmins,ou=Groups,dc=hq,dc=example,dc=com]/member* & user" write
    by * break

#idletimeout 30

#######################################################################
# ldbm and/or bdb database definitions
#######################################################################

authz-regexp "gidNumber=0\\\+uidNumber=0,cn=peercred,cn=external,cn=auth"
                "cn=root,dc=hq,dc=example,dc=com"

database        mdb
suffix          "dc=hq,dc=example,dc=com"
rootdn          "cn=root,dc=hq,dc=example,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw                secret
# rootpw                {crypt}ijFYNcSNctBYg
rootpw  {SSHA}7gMfpdvYlzgd4EmH3VbBCUsMHugjozU+
maxsize 85899345920
loglevel -1
sizelimit unlimited
checkpoint 1024 15

# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /var/lib/ldap

# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub
index sambaSID                          eq,sub
index sambaPrimaryGroupSID              eq
index sambaDomainName                   eq

# ldapsync provider setup
#sessionlog 100 100

It informs me it's a good configuration.

I copy this into /etc/openldap/memberof.ldif

systemctl enable slapd

systemctl start slapd

I then checked all the sub-dirs under slapd.d and saw:

Under /var/lib/ldap I see:

I then take my slapcat file from other instance and modify it inline with: