Change-History Checks

Overview

An Active Directory permission that lets someone write to an object can show No changes made with it in 90 days. The line is an absence proof. GraphnAI reads the object's replication metadata, the record each writable domain controller keeps of when each attribute last changed. If no value-changing write to the attributes the permission controls happened in the window, nothing was done with it.

Hover over the line to read "GraphnAI checked this object's change history on every domain controller", when it was last checked, and one row per writable domain controller:

• read directly, with when. The bridge read the object on that domain controller.
• covered through another domain controller's replication data, up to a date. The bridge couldn't reach that domain controller. A reachable one holds its replication data, and the check covers the object up to that date.
• couldn't be reached. Nothing covers that domain controller, so the check can't finish.

Rows with the oldest or no coverage come first.

What the line doesn't show

A write that set a value to what it already was leaves no trace, because Active Directory ignores it. If someone used a permission only that way, the line still reads "No changes made with it". Removing such a permission loses nothing the directory recorded.

The check covers permissions that write attributes: WriteDacl, WriteOwner, WriteSPN, WriteUPN, WriteGPLink, WriteAccountRestrictions, ForceChangePassword, AddMember, AddSelf, AddKeyCredentialLink and GenericWrite. GenericAll and AllExtendedRights can include read rights, which leave no change history, so they never read "No changes made with it".

---

Prerequisites

• Role: Viewer to read the lines. Operator or higher to run Check now.
• A connected bridge for the object's domain, updated to the current version.
• Reach to every writable domain controller. See Reach every writable domain controller.

---

Step-by-step

Run Check now

To read the change history yourself, open the edge and find the bar at the top of Permissions in this grant.

1. Check the bar. It reads "Last checked 12 minutes ago". If the object has never been checked, only the button shows.
2. Select Check now. You need the Operator role or higher. Viewers see the "Last checked" text and no button.
3. Wait while the button reads Checking… and the bar says "Reading change history from each domain controller." The bridge reads each writable domain controller. A check takes a few seconds, and at most 55 seconds.
4. Read the permission lines. They update when the check finishes.

A check counts for 30 minutes. A later check, or an automatic removal that needs one, runs again when the last one is older. After 30 minutes the lines read "Not checked yet", with "The last check was 41 minutes ago, which is too old to rely on."

The bar can also say:

A membership (Member of) edge has no Check now. The check runs for one object, and a membership isn't one. Open the group's own permission edge instead.

Reach every writable domain controller

For a proof in a domain, the bridge must reach every writable domain controller of that domain, the same way it reaches the domain: over verified TLS (LDAPS, or StartTLS with a certificate the bridge trusts) when Use TLS is on. Alternatively, each domain controller it can't reach must replicate into a reachable one within 30 minutes.

Otherwise that domain controller's coverage is too old, and every proof in the domain waits. A domain with Use TLS off reads every domain controller in plain LDAP, which sends the service account's password unencrypted. That's insecure and not recommended: use it for testing only, and the bridge logs a warning for each domain controller it reads that way.

To fix it, open the firewall from the bridge host to the domain controller on port 636, or make its certificate trusted. See Bridge Configuration.

Domain controllers in other sites replicate less often. One you can't reach may look too old most of the time. Let the bridge reach it.

When a check can't verify a permission

Each of these reads "Can't be verified yet" with a reason line.

An automatic removal that needs a proof waits on these too. Until the line reads "No changes made with it", the removal waits for your approval.

---

Configuration

An administrator can tune two settings. Ask your GraphnAI deployment team to change them.

• Freshness window: how recent a check, and every domain controller's coverage, must be. The default is 30 minutes. The range is 5 minutes to 2 hours. A value outside the range uses 30 minutes.
• Check timeout: how long one check may run. The default is 55 seconds. The range is 15 to 55 seconds. A value outside that range is moved to the nearest limit.

---

Troubleshooting

Every permission on an object reads "Can't be verified yet" after Check now

• Cause: One writable domain controller holds back every proof in its domain, usually one that stopped replicating or that the bridge can't reach.
• Fix: Read the reason line and the hover rows. See Reach every writable domain controller.

A check keeps failing

• Cause: The bridge is old, busy or can't read the object's change history.
• Fix: Update the bridge. Select Check now again after a minute.

Check now doesn't appear

• Cause: You have the Viewer role, or the edge is a membership or an Entra ID edge.
• Fix: Ask an operator to run it, or open the permission edge on the object.

---

Related Documentation

• Relationship Detail Drill-Down: the edge panel where the lines appear
• Bridge Configuration: the controllers the bridge reads, and the ports it needs
• Semi-Auto Execution and Full-Auto Execution: automatic removals that wait for a check