Created attachment 15897 [details] WIP patches on top of v4-10-test While doing a migration from a Samba AD domain to Windows I noticed that Windows 2008R2 resets instanceType of CN=Configuration from 13 (0xD) (WRITE, IS_NC_HEAD, NC_ABOVE) to 5 (WRITE, IS_NC_HEAD) after the initial replication happened. I remembered that objects with IS_NC_HEAD and NC_ABOVE are typically part of two naming contexts, but our partition module doesn't reflect that. For the normal LDAP interface this doesn't matter as referrals are generated, but it's actually a bug for our DsGetNCChanges() server. I created a prof of concept patch that is able to avoid the problem and instanceType stays at 13 on Windows.