Let TO be the object from which the msDS-Approx-Immed-Subordinates attribute is being read.

The value of TO!msDS-Approx-Immed-Subordinates is the approximate number of direct descendants of this object if TO!nTSecurityDescriptor grants RIGHT_DS_LIST_CONTENTS to the client. This estimate has no guarantee or requirement of accuracy. If the client does not have the RIGHT_DS_LIST_CONTENTS access right, the value 0 is returned as the estimate.