3.1.1.4.5.16 msDS-KeyVersionNumber

msdn link

The msDS-KeyVersionNumber attribute exists on AD DS but not on AD LDS.

Let TO be the object from which the msDS-KeyVersionNumber attribute is being read.

If the fKVNOEmuW2k heuristic of the dSHeuristics attribute (see section 6.1.1.2.4.1.2) is TRUE, TO!msDS-KeyVersionNumber equals 1. Otherwise, TO!msDS-KeyVersionNumber equals the dwVersion field of the AttributeStamp associated with TO's unicodePwd attribute. See section 3.1.1.1.9 for more information about AttributeStamp and dwVersion.