https://bugs.openldap.org/show_bug.cgi?id=9794
--- Comment #1 from Ondřej Kuzník ondra@mistotebe.net --- This sounds too complicated, why not just acknowledge the change and leave it at that?
""" If the value of either pwdMaxAge or pwdMinAge is non-zero and the change does not include a pwdChangedTime update already, the server updates the pwdChangedTime attribute on the entry to the current time. """