Question about User Attributes

Question

I've noticed that sometimes when users are added to groups, the timestamp of the user object is not updated. If you execute LDAP queries against the modifytimestamp field, this creates inaccurate results.

Here is an example:

Notice the "When Changed" attribute of the user object (after the adding the user to the group) (scroll to right to see entire image):

Here is the activity log for this user (scroll to right to see entire image):

Here is the group membership of the user (as seen in the web interface) (scroll to right to see entire image):

Answer 1

Hello,

When you add a user to a group, the When Changed property should not be updated. When you add a user to a group, you don't modify the user. Instead, you modify the group by adding the user's DN to the Member property of the group.

The Member Of property of the user is simply a backlink to the Member property of all the groups the user is a member of.

Comments

So - if you edited a user, and then added them to a group it would update this timestamp. Alternatively, if you find the group first and then add the user to that group, the timestamp would not be updated on the user object. Is this correct?

Thanks!

---

I found my answer. I hope this can help others with similar confusion....

We do a ton of LDAP lookups here and this has always been a question.

"This attribute is not stored—it is a computed back-link attribute." http://msdn.microsoft.com/en-us/library/ms677943.aspx

The interesting scenario is that if you add a user to 50 new groups, then ask if the user has been "updated" via the modifytimestamp attribute of the user, you get "no" as the answer. To me, the answer is yes, the user has been updated, but I guess that is just me....

If you ignore the modifytimestamp of the user and just ask for the groups (memberof), you do get the correct answer. So, now I know that you cannot depend on the modifytimestamp of the user attribute to detect if the user's group membership has been altered.

---

Hello,

That's, actually, what we tried to say in our previous post :)

When you add a user to a group, the group is modified, not the user.