Can someone explain what the 'whenChanged ' attribute is for in AD. We have recently been running a report on this attribute because I believe this attribute will will tell what accounts have changed in Active Directory but we are getting loads of reported updates on user accounts that I cannot explain



The whenChanged attribute is updated anytime a local write occurs. It's not a replicated attribute (e.g. maintained locally on each domain controller).

If you want to see what changed specifically,

Look at repadmin /showobjmeta:"DN of object goes here".

Thanks, Brian Desmond Active Directory MVP


I can't find any information on a "whatschanged" attribute. The closest is the whenChanged attribute which is merely a timestamp which is updated when any other object property changes.

Where do you see "whatschanged" and how are you generating a report?

  • Sorry Graeme it is the whenchanged attribute – user17735 Aug 21 '09 at 10:47
  • I take it that an object can be a user account but is there a way of knowing what property has changed? – user17735 Aug 21 '09 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy