The functional level of the DC on which the modification is taking place is at least DS_BEHAVIOR_WIN2012.

The object is an nTDSDSA object.

The DC that the object represents is an RODC.

The object's parent is a server object.

The computer object specified by the serverReference attribute of the server object that is the parent of the object being modified represents the requester. In other words, it is allowed that an RODC itself can update the msDS-Behavior-Version attribute of its nTDSDSA object on a writable DC.

The requester must have the Validated-MS-DS-Behavior-Version validated write right.