Modifying a computer object's whenCreated attribute within Active Directory

Question

I would like to modify the "whenCreated" attribute on a computer object using AD Explorer from SysInternals. However, when I attempt to do it, I get the following error message in a dialog box:

Unable to update attribute:

The directory datatype cannot be converted to/from a native DS datatype

I am the owner of this computer object and have access to modify it. Is this not an attribute that can be updated on a Computer object?

Or are there any other ways to modify the creation date of this object? In essence, I'm looking for a "touch" utility for Active Directory objects.

Answer 1

The whenCreated attribute may not be modified except by the system. Here is the associated documentation for that attribute. Notice the "Update Privilege: This value is set by the system." and "System-Only: True" parts of the document. The whenChanged, createTimeStamp, and modifyTimeStamp attributes all follow the same pattern.

As far as I know, there's nothing you are going to be able to do to modify whenCreated or createTimeStamp short of deleting the object and actually re-creating it.

If you're looking for a way to query recently changed AD objects, you should be querying whenChanged or modifyTimeStamp. I'd suggest whenChanged because it's replicated in the global catalog.

To create a "touch* utility for AD objects, you'll need to find a non-important (to you) editable attribute that whenChanged is linked to. You can then tweak that attribute and it should subsequently update the whenChanged value. An example attribute might be description. If you really want to get complex and not mess with any built-in attributes, you could alter your AD schema to add your own attribute.