The msDS-KeyVersionNumber attribute exists on AD DS but not on AD LDS.

Let TO be the object from which the msDS-KeyVersionNumber attribute is being read.

If the fKVNOEmuW2k heuristic of the dSHeuristics attribute (see section is true, TO!msDS-KeyVersionNumber equals 1. Otherwise, TO!msDS-KeyVersionNumber equals the dwVersion field of the AttributeStamp associated with TO's unicodePwd attribute. See section for more information about AttributeStamp and dwVersion.