Active directory - ldap attribute createTimeStamp in Windows Server 2008 R2

To check how many users were created in the past one year for 开发者_如何学编程a particular domain I queried like the following,

(&(objectCategory=person)(objectClass=user)(!(sAMAccountType=805306370))(createTimeStamp>=20090831022227.0Z))

I have two domain controllers, DC-1 is Windows Server 2008 and DC-2 is Windows Server 2008 R2 and this query works fine with the 2008 Server & I found that there were 1500 new users in the last year, but 2008 R2 Server gives only 64 users. I have made the search for domain level & different OU levels and there is no change in the result count(64) but the users were different. I have also checked with other Domain DC's and for all other servers it works fine and another 2008 R2 Server alone gave the same result count, 64. I have also confirmed that this is not a replication issue.

Need Help.

I find strange that you use !(sAMAccountType=805306370) in the search criteria. There are different values for sAMAccountType. There are new supported values for new operation system (compare http://msdn.microsoft.com/en-us/library/cc220839(PROT.13).aspx and http://msdn.microsoft.com/en-us/library/cc228417(PROT.13).aspx. Moreover you write about user accounts, so the point of your interest are SAM_USER_OBJECT (0x30000000 or 805306368).

So I suggest to use the query

(&
  (objectCategory=person)
  (objectClass=user)
  (sAMAccountType=805306368)
  (createTimeStamp>=20090831022227.0Z)
)

and compare the results on both DCs. If you do have different results pick up some accounts which are in one set and not in another and search explicit for the account.

For createTimeStamp :

(&(objectCategory=person)(objectClass=user)(!(sAMAccountType=805306370))(createTimeStamp>=20090831022227.0Z)) which will fetch only 64 users irrespective of the domain/OU.

For whenCreated :

(&(objectCategory=person)(objectClass=user)(!(sAMAccountType=805306370))(whenCreated>=20090831022227.0Z)) which will fetch all the recently created users.

I'm still confused why createTimeStamp behaves differently for 2008 R2 alone.

PS: My domain functional level & forest functional level both are 2008 R2