Domain Changes

The Domin Changes option is a simple tool to display the changes that have been written to the domain controller, objects are displayed based on the changes to the USNChanged attribute.  When you press start it will read the highestCommittedUSN attribute from the RootDSE of the domain controller, and then at the specified interval, it will query all the name contexts on the server for any objects that have a higher USNChanged that the highCommittedUSN.  The highest USNChanged is then used for the next query, and so on.

All the name context on the server will be queried including the Global Catalog.  If an update is associated to a change in the GC context, the attribute field will start with GC:.

The screenshot below shows the details seen on DC in the root and sub domain for objects that were created in the sub domain.

Domain Change Root
Domain Changes Child Domain

With Domain Changes option running against the child domain, it captures the two groups and user object being created in the default naming context and the global catlog.  With the option running against the DC in the root domain at the same time, it only shows the objects being created in the global catlog.

Domain Changes - Deleting Objects

The screenshot above shows the updates that happened on the child domain, when the same object where deleted.  The object's DNs have changed because they have been renamed and moved to the deleted objects OU.

The status bar at the bottom of the object list, shows the server that is being monitored and the details on the USN that have been seen.

Domain Changes - Status Bar

The Highest USN is the highest USN that has been returned by the queries against all the name contexts, while Committed USN, is the value returned in the HighestCommitedUSN in the RootDSE.