I don't see anything in X.501/X.511 etc to imply there's any difference - should modifyTimeStamp be left untouched when an update only changes an entry's operational attributes, or should all modifications, regardless of how they were initiated or what they touch, update the modifyTimeStamp?
Possible alternatives: 1) only update modifyTimeStamp in response to actual Modify (and MoDDN) requests from a client. (thus, not for any internally generated updates.) 2) only update modifyTimeStamp if user attributes are changed. 3) always update modifyTimeStamp