I have been looking for a few hours now to find 'detailed' information on how the pass word notification driver actually works. It seems to use the heartbeat and current time variables but I do not understand how it gets the password expiration for each account. Best I can see it does an LDAP search but it seems like it would take a long time to query every account for that value nor does it seem like that would be efficient to scan every account and certain intervals. I have done research and read the following links, but I still just can't find the detailed information I am looking for on how this driver reads/gets the password expiration date for each account in the directory.

https://www.netiq.com/communities/co...ssible-issues/
https://www.netiq.com/communities/co...ervice-driver/
http://www.brummelhook.com/dirxml.html

Thank you in advance.