I can see some users making a lot of changes to their mSMQDigests attribute. this seems to be some automatic process, and not initiated by the end users. We do not use any ms MQ in the environment. Has anyone else come across this?
if you have splunk, the query I used is:index=<YOUR INDEX FOR DC LOGS> EventCode=5136 earliest=-30d  LDAPDisplayName=mSMQDigests | stats count by DN
if you want to get an overview of the changes per attribute, use:index=<YOUR INDEX FOR DC LOGS> EventCode=5136 earliest=-30d  | stats count by LDAPDisplayName | sort -count