How it works...
A lingering object usually exists on one domain controller and is not affected by Active Directory replication anymore, since all of the replication partners of the domain controller have the tombstone change as the last change for the object and delete the object from the database.
Lingering objects can be truly nasty. For instance, an Active Directory admin that was fired on the spot a couple of months ago might suddenly have access again, after another Active Directory admin may have restored a domain controller in an environment with a tombstone lifetime period of 60 days.
Active Directory admins might not be aware of lingering objects, unless they keep an eye out for unexpected Active Directory behavior. They don't need ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access