OK... in general.
If you make a connection to AD in RSA security console, you now have your internal database users with tokens already assigned, and also matching names in the AD connection with nothing assigned. You want to make the AD list of users the 'active one'?
Use the export users and tokens feature.
You can move users and tokens between identity sources this way.
[I can't go into the explicit details of every step, but using the help menu and this concept below, you'll be able to do it.]
-put the internal db users you want to move to the AD connection into a group (create some new internal group)
-export users and tokens, and export this group
-make a backup of the system [in case things go sour from here on out, you can get everything back ]
-now the users you exported are still active and still in internal database, so you now delete the users from internal database
-Import users and tokens, import the file you just exported, and during import, point them to the AD connection. If the first name, last name, and userid matches what you have in the AD connection, the import will associate the user and tokens and pins and everything to the AD connection.
-Run a report 'Imported users and tokens report' if you see any error messages when running the import job.
