Samba compare DN like (DN+binary and DN+String) just on the DN part when windows seems to treats two DN+Binary that differs only on the binary part to be 2 differents DN. As a result if a DN+Binary is modified it will send 2 updates in the linked attributes structure: 1 to remove the old DN+Binary 1 to add the new one