The Tombstone Lifetime on our system was set to 365 days. Microsoft explained this as meaning after a deletion the object is in the Deleted stage and recoverable for 365 days from the bin. After that time frame, the object moves to the Recycled stage (not recoverable) but remains in the database for another 365 days. Total time from AD deletion to physical deletion - 730 days. They said after 365 days, the Recycled object would not be recoverable, but they did not specify if it would be visible in the GUI. Not being recoverable, one would think they should not be visible when in the Recycled stage. Here is an
article seeming to support the stages.
We determined our recycle bin was too large, as we have over 99999 objects and cannot see all deleted objects in the GUI, which we could a few months back. Thus we decided to return back to the default of 180 days for Tombstone Lifetime, so we made the change:
CN=Configuration,DC=intran
et,DC=hdr → CN=Services → CN=Windows NT → CN=Directory Service, changed tombstoneLifetime attribute in the Attribute Editor tab to 180.
I made the change on Friday, 4/3/20, but I can still see objects that are a year old and I am able to restore them. I watched an object drop out that was due to expire earlier today so it is scavenging. But shouldn't I only be seeing items that are 6 months old and not seeing Recycled objects that are not recoverable? Or am I misunderstanding things?
Notes:
AD domain is 2012R2 DFL, while Schema is 2016.
Thanks!