troubleshooting Question

AD Recycle Bin Tombstone Lifetime

Avatar of Gerald DiBernardo
Gerald DiBernardo asked on
Active DirectoryWindows 10AzureWindows Server 2012Windows Server 2016
5 Comments1 Solution102 ViewsLast Modified:
The Tombstone Lifetime on our system was set to 365 days. Microsoft explained this as meaning after a deletion the object is in the Deleted stage and recoverable for 365 days from the bin. After that time frame, the object moves to the Recycled stage (not recoverable) but remains in the database for another 365 days. Total time from AD deletion to physical deletion - 730 days. They said after 365 days, the Recycled object would not be recoverable, but they did not specify if it would be visible in the GUI. Not being recoverable, one would think they should not be visible when in the Recycled stage. Here is an article seeming to support the stages.

We determined our recycle bin was too large, as we have over 99999 objects and cannot see all deleted objects in the GUI, which we could a few months back. Thus we decided to return back to the default of 180 days for Tombstone Lifetime, so we made the change:

CN=Configuration,DC=intranet,DC=hdr → CN=Services → CN=Windows NT → CN=Directory Service, changed  tombstoneLifetime attribute in the Attribute Editor tab to 180.

I made the change on Friday, 4/3/20, but I can still see objects that are a year old and I am able to restore them. I watched an object drop out that was due to expire earlier today so it is scavenging. But shouldn't I only be seeing items that are 6 months old and not seeing Recycled objects that are not recoverable? Or am I misunderstanding things?

Notes:
AD domain is 2012R2 DFL, while Schema is 2016.

Thanks!
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 1 Answer and 5 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 5 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros