Determine & Change Tombstone Lifetime in Active Directory
Recently, I wanted to know what the tombstone lifetime was in my environment and decided to find this using PowerShell. There are a number of ways I could do this but dong it through PowerShell would be much easier. For those of you that are new to the attribute, a good explanation of it is:
The number of days before a deleted object is removed from the directory services. This assists in removing objects from replicated servers and preventing restores from reintroducing a deleted object.
Tombstone Lifetime is used to determine how long a deleted object in the Active Directory database (NTDS.dit) is stored. When object is deleted, it does not immediately delete from the AD database. Instead, the object as deleted is marked where the is-Deleted attribute is set to true. Additions, most attributes are removed and the object will be renamed as follows: CN=<old RDN>\0ADEL:<objectGUID>
After renaming the object is moved to the hidden Deleted Objects container. At this time, the deleted object is referred to as tombstone. Then replicates these changes to all other DCs. Only when the tombstone lifetime has been exceeded, the object is permanently removed from the AD database.
The tombstone lifetime is set with the install of the first DCs in a forest for all domains. The tombstone lifetime is not configurable per domain.
Windows 2000 (all SPs) = 60 days
Windows Server 2003 without SP = 60 days
Windows Server 2003 with SP1 = 180 days
Windows Server 2003 R2 with SP1 installed with both R2 discs = 60 days
Windows Server 2003 R2 with SP1 installed only with the first R2 Disc = 180
daysWindows Server 2003 with SP2 = 180 days
Windows Server 2003 R2 with SP2 = 180 days
Windows Server 2008 = 180 days
Windows Server 2008 R2 = 180 days
Windows Server 2012 = 180 days
Windows Server 2012 R2 = 180 days
Windows Server 2016 = 180 days
Windows Server 2019 = 180 days
More info:https://docs.microsoft.com/en-us/previous-versions/technet-magazine/cc137800(v=msdn.10)
AD Recycle Bin
The AD Recycle Bin enables rapid restoration of deleted objects without a restore operation by implementing two new attributes, and using two existing attributes:
- isDeleted
- Has existed since Windows 2000
- Exists on every object
- Describes if an object is deleted but restorable
- isRecycled
- New to Windows Server 2008 R2
- Exists on every object once it is recycled
- Describes if an object is deleted but not restorable
- msDS-deletedObjectLifetime
- New to Windows Server 2008 R2
- Is set on the “CN=Directory Service,CN=Windows NT, CN=Services, CN=Configuration, DC=COMPANY,DC=COM” container
- Describes how long a deleted object will be restorable
- tombstoneLifetime
- Has existed since Windows 2000
- Is set on the “CN=Directory Service,CN=Windows NT, CN=Services, CN=Configuration, DC=COMPANY,DC=COM” container
- Describes how long a deleted object will not be restorable
Basically, I wanted to know how long I had to recover if (in my case) one of my domain controllers were down for an extended period of time. For more information on the fun that can occur if this happens and it is down beyond the tombstone lifetime, check out this article: http://technet.microsoft.com/en-us/library/cc786630(v=ws.10).aspx
Determining Tombstone Lifetime:
PowerShell Code:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
Write-Output “Get Tombstone Setting `r” #Import the AD Module Import-Module ActiveDirectory #Get the Domain Configuration $ADForestconfigurationNamingContext = (Get-ADRootDSE).configurationNamingContext #Get Schema details $DirectoryServicesConfigPartition = Get-ADObject -Identity “CN=Directory Service,CN=Windows NT,CN=Services,$ADForestconfigurationNamingContext” -Partition $ADForestconfigurationNamingContext -Properties * #Store the tombstone value $TombstoneLifetime = $DirectoryServicesConfigPartition.tombstoneLifetime #Result Write-Output “Active Directory’s Tombstone Lifetime is set to $TombstoneLifetime days `r “ |
Upon successful execution it should return a numeric value and that’s how many days before the DC tombstones.
This happens if your enviornment has gones throught a few generations of upgrades! 🙂
Changing Tombstone Lifetime:
PowerShell:
|
1 2 3 4 5 6 7 8 |
#Import the AD Module Import-Module ActiveDirectory #Get the Domain Configuration $ADForestconfigurationNamingContext = (Get-ADRootDSE).configurationNamingContext #Set the TombStone Lifetime Set-ADObject -Identity “CN=Directory Service,CN=Windows NT,CN=Services,$ADForestconfigurationNamingContext” -Partition $ADForestconfigurationNamingContext -Replace @{tombstonelifetime=’365′} |
This same process can be leveraged to identify the msDS-deletedObjectLifetime value (180 days by default).
The tombstone lifetime of an AD forest can be modified using the ADSIEdit tool by following this procedure:
- At an elevated command prompt, type adsiedit.msc.
- Right-click ADSI Edit in the left pane and select Connect to.
- In the Connection Point section, select the Select a well known Naming Context radio button and select Configuration from the dropdown list.
- Expand Configuration; CN=Configuration,DC=<forest_root_domain>; CN=Services; and CN=Windows NT
- Right-click CN=Directory Service and select Properties.
- In the Attribute Editor tab of the properties window, locate the tombstoneLifetime attribute. The value of this attribute represents the forest’s current tombstone lifetime in days. If the attribute’s value shows <not set>, the tombstone lifetime of the forest is 60 days.
- To modify the tombstone lifetime, click Edit.
- Type the desired tombstone lifetime and click OK. Click OK again to close the properties window. The change takes effect immediately.
