16.18. Modifying the Tombstone Lifetime for a Domain
Problem
You want to change the default tombstone lifetime for a domain.
Solution
Using a graphical user interface
Open ADSI Edit.
In the left pane, expand
cn=Configuration
→cn=Services
→cn=Windows NT
.Right-click on
cn=Directory
Service
and select Properties.Set the
tombstoneLifetime
attribute to the number of days that tombstone objects should remain in Active Directory before getting removed completely (the default is 60 days).Click OK.
Using a command-line interface
Create an LDIF file called
change_tombstone_lifetime.ldf
with the following
contents:
dn: cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration,<ForestRootDN
> changetype: modify replace: tombstoneLifetime tombstoneLifetime: <NumberOfDays
> -
then run the following command:
> ldifde -v -i -f change_tombstone_lifetime.ldf
Using VBScript
' This code modifies the default tombstone lifetime
' ------ SCRIPT CONFIGURATION ------
intTombstoneLifetime = <NumberOfDays
>
' ------ END CONFIGURATION ---------
set objRootDSE = GetObject("LDAP://RootDSE")
set objDSCont = GetObject("LDAP://cn=Directory Service,cn=Windows NT," & _
"cn=Services," & objRootDSE.Get("configurationNamingContext") )
objDSCont.Put "tombstoneLifetime", intTombstoneLifetime
objDSCont.SetInfo
WScript.Echo "Successfully set the tombstone lifetime to " & _
intTombstoneLifetime
Discussion
It is not recommended that you change this setting unless you have a very good reason. Lowering this value below the 60-day ...
Get Active Directory Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.