If an endpoint account template has a password mapping in place and strong synchronization enabled, does the endpoint account password get updated when the global user's password is changed?
The %P% rulestring in an Account Template is only utilized during the initial account creation. When a provisioning global user password change takes place that new password will propagate to the associated endpoint accounts, assuming you choose to sync with accounts and assuming that the endpoint does not have password propagation disabled. This propagation will always occur regardless of strong or weak sync and even if there is no account template in place. Password and Status are the two fields that will propagate even without a template.