Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can someone explain what the 'whenChanged ' attribute is for in AD. We have recently been running a report on this attribute because I believe this attribute will will tell what accounts have changed in Active Directory but we are getting loads of reported updates on user accounts that I cannot explain


share|improve this question
up vote 4 down vote accepted

The whenChanged attribute is updated anytime a local write occurs. It's not a replicated attribute (e.g. maintained locally on each domain controller).

If you want to see what changed specifically,

Look at repadmin /showobjmeta:"DN of object goes here".

Thanks, Brian Desmond Active Directory MVP

share|improve this answer

I can't find any information on a "whatschanged" attribute. The closest is the whenChanged attribute which is merely a timestamp which is updated when any other object property changes.

Where do you see "whatschanged" and how are you generating a report?

share|improve this answer
Sorry Graeme it is the whenchanged attribute – user17735 Aug 21 '09 at 10:47
I take it that an object can be a user account but is there a way of knowing what property has changed? – user17735 Aug 21 '09 at 10:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.