The tombstone lifetime in an Active Directory forest determines how long a deleted object (called a “tombstone”) is retained in Active Directory Domain Services (AD DS). The tombstone lifetime is determined by the value of the tombstoneLifetime attribute on the Directory Service object in the configuration directory partition.
You can use this procedure to determine the tombstone lifetime for the forest.
Membership in Domain Users, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at Active Directory Default Groups (http://go.microsoft.com/fwlink/?LinkId=83477).
To determine the tombstone lifetime for the forest
-
Click Start, point to Administrative Tools, and then click ADSI Edit.
-
In ADSI Edit, right-click ADSI Edit, and then click Connect to.
-
For Connection Point, click Select a well known Naming Context, and then click Configuration.
-
If you want to connect to a different domain controller, for Computer, click Select or type a domain or server: (Server | Domain [:port]). Provide the server name or the domain name and Lightweight Directory Access Protocol (LDAP) port (389), and then click OK.
-
Double-click Configuration, CN=Configuration,DC=ForestRootDomainName, CN=Services, and CN=Windows NT.
-
Right-click CN=Directory Service, and then click Properties.
-
In the Attribute column, click tombstoneLifetime.
-
Note the value in the Value column. If the value is <not set>, the default value is in effect as follows:
-
On a domain controller in a forest that was created on a domain controller running Windows Server 2003 with Service Pack 1 (SP1), Windows Server 2003 with Service Pack 2 (SP2), Windows Server 2008, or Windows Server 2008 R2, the default value is 180 days.
-
On a domain controller in a forest that was created on a domain controller running Windows 2000 Server, Windows Server 2003, or Windows Server 2003 R2, the default value is 60 days.
To determine the tombstone lifetime for the forest using Dsquery
-
Open a Command Prompt window. To open a command prompt, click Start, click Run, type cmd, and then press ENTER.
-
At the command prompt, type the following command, and then press ENTER:
dsquery * “cn=directory service,cn=windows nt,cn=services,cn=configuration,dc=<forestDN>” –scope base –attr tombstonelifetime
Be sure to replace <forestDN> with the actual distinguished name of the forest. For example, if your forest name is corp.proseware.com, type the following, and then press ENTER:
dsquery * “cn=directory service,cn=windows nt,cn=services,cn=configuration,dc=corp,dc=proseware,dc=com” –scope base –attr tombstonelifetime