Windows Proxy is unable to manage Domain Accounts from all members of a CA PAM cluster.
It turns out that CA PAM requires that port 389 be open on the Domain Controller to all CA PAM instances in the cluster. The documentation, the 2.7 and 2.8 CA PAM WIKIs, currently specify only port 636. This is not correct.
Make sure that your firewalls allow port 389 to be open to all CA PAM instances in your cluster, in addition to 636. The documentation will be updated to reflect this requirement.