Avatar of Gerald DiBernardo
Gerald DiBernardo

asked on 

AD Recycle Bin Tombstone Lifetime

The Tombstone Lifetime on our system was set to 365 days. Microsoft explained this as meaning after a deletion the object is in the Deleted stage and recoverable for 365 days from the bin. After that time frame, the object moves to the Recycled stage (not recoverable) but remains in the database for another 365 days. Total time from AD deletion to physical deletion - 730 days. They said after 365 days, the Recycled object would not be recoverable, but they did not specify if it would be visible in the GUI. Not being recoverable, one would think they should not be visible when in the Recycled stage. Here is an article seeming to support the stages.

We determined our recycle bin was too large, as we have over 99999 objects and cannot see all deleted objects in the GUI, which we could a few months back. Thus we decided to return back to the default of 180 days for Tombstone Lifetime, so we made the change:

CN=Configuration,DC=intranet,DC=hdr → CN=Services → CN=Windows NT → CN=Directory Service, changed  tombstoneLifetime attribute in the Attribute Editor tab to 180.

I made the change on Friday, 4/3/20, but I can still see objects that are a year old and I am able to restore them. I watched an object drop out that was due to expire earlier today so it is scavenging. But shouldn't I only be seeing items that are 6 months old and not seeing Recycled objects that are not recoverable? Or am I misunderstanding things?

Notes:
AD domain is 2012R2 DFL, while Schema is 2016.

Thanks!
Active DirectoryWindows 10AzureWindows Server 2012Windows Server 2016

Avatar of undefined
Last Comment
Gerald DiBernardo

8/22/2022 - Mon