Active Directory + whenChanged attribute

Question

Can someone explain what the 'whenChanged ' attribute is for in AD. We have recently been running a report on this attribute because I believe this attribute will will tell what accounts have changed in Active Directory but we are getting loads of reported updates on user accounts that I cannot explain

thanks

Answer 1

The whenChanged attribute is updated anytime a local write occurs. It's not a replicated attribute (e.g. maintained locally on each domain controller).

If you want to see what changed specifically,

Look at repadmin /showobjmeta:"DN of object goes here".

Thanks, Brian Desmond Active Directory MVP

Answer 2

I can't find any information on a "whatschanged" attribute. The closest is the whenChanged attribute which is merely a timestamp which is updated when any other object property changes.

Where do you see "whatschanged" and how are you generating a report?