Windows 2000 Active Directory Tombstone Garbage Collection

In Microsoft Windows 2000 Active Directory, deleting an object does not immediately eradicate it from the directory database. Instead, the object is converted into a tombstone state to allow the deletion to replicate across all domain controllers, and it is later permanently purged through an automated background operation known as garbage collection. This article explains the lifecycle of a deleted object, how the tombstone lifetime operates, and the step-by-step mechanism Windows 2000 uses to execute garbage collection.

The Object Deletion and Tombstoning Phase

When an object is deleted in Windows 2000 Active Directory:

  1. Attribute Stripping: The Directory System Agent (DSA) strips the majority of the object's attributes, retaining only vital identifiers required for replication and identification. These preserved attributes include objectGUID, objectSid, USNChanged, whenCreated, and whenChanged.
  2. Flagging: Active Directory sets the attribute isDeleted to TRUE.
  3. Relocation: The object is moved to the hidden CN=Deleted Objects container within its respective directory partition.
  4. Replication: The tombstone is replicated to other domain controllers via standard directory replication, ensuring all nodes recognize that the object has been removed.

The Tombstone Lifetime

A tombstone cannot be immediately deleted because doing so would risk "resurrecting" the object if a domain controller that had not yet received the deletion replicated with a partner. To prevent this, Windows 2000 enforces a Tombstone Lifetime (TSL), which defaults to 60 days. The tombstone persists in the database for the entirety of this period, allowing sufficient time for replication across the entire forest topology.

The Garbage Collection Mechanism

Garbage collection is an internal maintenance thread running within the Local Security Authority Subsystem Service (LSASS) on each domain controller. It operates independently on every domain controller and processes tombstoned records using the following steps:

1. Interval Trigger

By default, the garbage collection process runs automatically every 12 hours on each Windows 2000 domain controller. This interval is controlled by the garbageCollPeriod attribute located on the directory service configuration container (CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=domain,DC=com).

2. Identifying Expired Tombstones

When the garbage collection thread awakens, it scans the Extensible Storage Engine (ESE) database (NTDS.DIT) for objects where:

  • The isDeleted attribute is set to TRUE.
  • The timestamp in the whenChanged attribute is older than the current system time minus the Tombstone Lifetime (i.e., Current Time - whenChanged > 60 days).

3. Physical Database Purge

Once an expired tombstone is identified:

  • The garbage collector permanently removes the object record and its metadata from the NTDS.DIT database table.
  • This removal is local to that specific domain controller. Because the tombstone was already replicated forest-wide during its initial 60-day lifespan, the physical purging process does not generate replication traffic.

4. Online Defragmentation

Immediately following the removal of expired tombstone records, the garbage collection process triggers an online database defragmentation pass. This operation reclaims empty database pages left behind by deleted objects and optimizes space within NTDS.DIT, making that space available for new Active Directory objects without requiring directory downtime.