Thank you both for your answers.
Sorry I should've included more lines in my log.
Bindings with the passSync user are ok. But after that, the system tries to bind with the user whose password is being changed and that's when it fails:
This is what happens when user jmml01 changes his password in Windows and he was connected to the failing controller:
08/30/16 08:28:56: Attempting to sync password for jmml01
08/30/16 08:28:56: Searching for (ntuserdomainid=jmml01)
08/30/16 08:28:56: Checking password failed for remote entry: uid=jmml01,ou=xxxxxxx
08/30/16 08:28:56: Deferring password change for jmml01
08/30/16 08:28:56: Backing off for 4096000ms
389ds:
[30/Aug/2016:08:28:56 +0200] conn=262 fd=66 slot=66 SSL connection from A.B.C.D to A1.B1.C1.D1
[30/Aug/2016:08:28:56 +0200] conn=262 TLS1.2 256-bit AES
[30/Aug/2016:08:28:56 +0200] conn=262 op=0 BIND dn="uid=winsync,ou=xxxxxx" method=128 version=3
[30/Aug/2016:08:28:56 +0200] conn=262 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=winsync,ou=xxxxx"
[30/Aug/2016:08:28:56 +0200] conn=262 op=1 SRCH base="ou=usuarios,ou=xxx" scope=2 filter="(ntUserDomainId=jmml01)" attrs=ALL
[30/Aug/2016:08:28:56 +0200] conn=262 op=1 RESULT err=0 tag=101 nentries=1 etime=0
[30/Aug/2016:08:28:56 +0200] conn=263 fd=67 slot=67 SSL connection from A.B.C.D to A1.B1.C1.D1
[30/Aug/2016:08:28:56 +0200] conn=263 TLS1.2 256-bit AES
[30/Aug/2016:08:28:56 +0200] conn=263 op=0 BIND dn="uid=jmml01,ou=xxxxx" method=128 version=3
[30/Aug/2016:08:28:56 +0200] conn=263 op=0 RESULT err=53 tag=97 nentries=0 etime=0
[30/Aug/2016:08:28:56 +0200] conn=263 op=1 UNBIND
However if the user was connected on the other controller, the password will be successfully changed. I also believe it's a certificate problem , I'm going to review my config on that side.
Regards!