samba - Apr 2016 - LDAP mismatch between DCs

Running "samba-tool ldapcmp ldap://DC1 ldap://DC2 -Uadministrator" on 
our production system results in mismatches for items in the domain section:

* Comparing [DOMAIN] context...

* Objects to be compared: 625

Comparing:
'CN=AdminRole,OU=Group,OU=Postgres,DC=ourdomain' [ldap://DC1]
'CN=AdminRole,OU=Group,OU=Postgres,DC=ourdomain' [ldap://DC2]
     Difference in attribute values:
         whenChanged =>
['20160111045058.0Z']
['20160111045103.0Z']

This is repeated for all other entries in the section, although the 
timestamps differ. All other sections match perfectly.

Is this something to be concerned about or can it be safely ignored?

regards,
John

Hi,

I think this is expected. You should filter whenChanged out, when doing 
ldapcmp, with --filter=whenChanged

MJ

On 04/14/2016 04:02 AM, John Gardeniers wrote:
> Running "samba-tool ldapcmp ldap://DC1 ldap://DC2
-Uadministrator" on
> our production system results in mismatches for items in the domain
> section:
>
> * Comparing [DOMAIN] context...
>
> * Objects to be compared: 625
>
> Comparing:
> 'CN=AdminRole,OU=Group,OU=Postgres,DC=ourdomain' [ldap://DC1]
> 'CN=AdminRole,OU=Group,OU=Postgres,DC=ourdomain' [ldap://DC2]
>      Difference in attribute values:
>          whenChanged =>
> ['20160111045058.0Z']
> ['20160111045103.0Z']
>
> This is repeated for all other entries in the section, although the
> timestamps differ. All other sections match perfectly.
>
> Is this something to be concerned about or can it be safely ignored?
>
> regards,
> John
>
>