Determine the tombstone lifetime for the forest
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows
Server 2003 with SP1, Windows Server 2003 with SP2, Windows Server 2008,
Windows Server 2008 Foundation, Windows Server 2008 R2, Windows Server 2008 R2
Foundation, Windows Server 2012
The tombstone lifetime in an Active Directory forest
determines how long a deleted object (called a “tombstone”) is retained in
Active Directory Domain Services (AD DS). The tombstone lifetime is
determined by the value of the tombstoneLifetime attribute on the
Directory Service object in the configuration directory partition.
You can use this procedure to determine the tombstone lifetime for
the forest.
Membership in Domain Users, or equivalent,
is the minimum required to complete this procedure. Review details about using
the appropriate accounts and group memberships at Local
and Domain Default Groups (http://go.microsoft.com/fwlink/?LinkId=83477).
To determine the
tombstone lifetime for the forest using ADSIEdit
- Click Start, point to Administrative Tools,
and then click ADSI
Edit.
- In
ADSI Edit, right-click ADSI Edit, and then click Connect to.
- For Connection
Point, click Select a well
known Naming Context, and then click Configuration.
- If
you want to connect to a different domain
controller,
for Computer, click Select or type a domain
or server:
(Server | Domain [:port]). Provide the server
name
or the domain
name
and Lightweight Directory
Access Protocol (LDAP) port (389), and then click OK.
- Double-click Configuration, CN=Configuration,DC=ForestRootDomainName, CN=Services,
and CN=Windows NT.
- Right-click CN=Directory Service,
and then click Properties.
- In
the Attribute column, click tombstoneLifetime.
- Note
the value in the Value column. If the value is <not set>,
the value is 60
days.
To determine the
tombstone lifetime for the forest using Dsquery
- Open
a Command Prompt window. To open a command prompt, click Start,
click Run, type cmd, and then press ENTER.
- At
the command prompt, type the following command, and then press ENTER:
dsquery * "cn=directory
service,cn=windows nt,cn=services,cn=configuration,dc=<forestDN>"
–scope base –attr tombstonelifetime
Be sure to
replace <forestDN> with the actual distinguished
name of the forest. For example, if your forest name is xyz.com, type the
following, and then press ENTER
dsquery * "cn=directory
service,cn=windowsn t,cn=services,cn=configuration,dc=xyz,dc=com" -scope
base -attr tombstonelifetime
