The first step in troubleshooting a RUS that’s not stamping is to verify that it’s checking for changes at all.
In ADSI Edit or LDP, connect to the DC that the RUS points to, and find your test user.
If you do not find an 8012 event corresponding to the 8011, then Exchange did not see a response to that search.
Typically this would indicate a network problem and cause the RUS to hang at that point.
After that you usually do not see any more 8011 queries against the root of the domain, because the RUS continues to wait for a response to this search.
These permissions come from the Exchange Enterprise Servers group, which is granted permissions at the root of the domain when setup /domainprep is run.
If these permissions are changed, or if inheritance on a subcontainer is removed, this can prevent Exchange from seeing the user.
Once you know which RUS you’re looking at, and which user you’re expecting it to stamp, you can begin taking a closer look at what the RUS is doing.