The constructed attribute modifyTimeStamp always == whenChanged?

So if you read up on modifyTimeStamp – for example here: or at MSDN: “modifyTimeStamp” is a constructed attribute and as Joe points out it’s based on the “whenChanged” attribute and that assumption is right in 99,9% of all cases, BUT not always – So where is the exception?

The exceptional case

The exception is the DMD or the SubSchemaSubEntry “CN=Aggregate,CN=Schema,CN=Configuration,DC=X

Let’s have a look with LDP.exe:

So this clearly shows that ‘modifyTimeStamp’ is NOT based on the ‘whenChanged’ attribute for the subSchemaEntry.

How it really works

Let’s agree we have confirmed that, so to the next question, what is it based on? Well it’s based on the last time the in-memory schema cache of the particular DC was updated either during boot or by manually triggering the operational attribute “SchemaUpdateNow:1”

So let’s try that?

So let’s have a look again:

Yes – “modifyTimeStamp” now shows todays date: 2013-06-28 instead of previously 2013-06-21 J

Why it was implemented

So I guess now there is really one good question left, why?

The answer can be found if you read up on RFC 2251 that says:

“modifyTimestamp: the time this entry was last modified” – you can read further on MSDN where you can see what functionality defined in RFC 2551 Active Directory has implemented:

Windows Server 2012 R2 Preview seems to introduce a defunct attribute

It’s late and I’ve just gone thru the “Windows Server 2012 R2 Preview” schema aka “Schema 69” and it seems like it first introduces an attribute to the schema that it later on in the process will defunct.

Table 1: Sch61.ldf

Introduces the attribute msDS-DrsFarmID

dn: CN=ms-DS-Drs-Farm-ID,CN=Schema,CN=Configuration,DC=X

changetype: ntdsSchemaAdd

objectClass: attributeSchema

cn: ms-DS-Drs-Farm-ID

adminDisplayName: ms-DS-Drs-Farm-ID

adminDescription: This attribute stores the name of the federation service this DRS object is associated with.

ldapDisplayName: msDS-DrsFarmID

attributeId: 1.2.840.113556.1.4.2265

omSyntax: 64


isSingleValued: TRUE

instanceType: 4

searchFlags: 0

isMemberOfPartialAttributeSet: TRUE

systemOnly: TRUE

schemaIdGuid:: ZvdVYC4gzUmovuUrsVnt+w==

systemFlags: 16


Table 2: Sch61.ldf

Modifys the attribute msDS-DrsFarmID

dn: CN=ms-DS-Drs-Farm-ID,CN=Schema,CN=Configuration,DC=X

changetype: ntdsSchemaModify

add: showInAdvancedViewOnly

showInAdvancedViewOnly: TRUE


Table 3: Sch67.ldf

Makes the attribute msDS-DrsFarmID defunct

dn: CN=ms-DS-Drs-Farm-ID,CN=Schema,CN=Configuration,DC=X

changetype: ntdsSchemaModify

add: isDefunct

isDefunct: TRUE

I don’t want more crap in my dev forest than I have to so I’m going to comment those out.