Windows 2000 Active Directory Tombstone Lifetime

This article provides an overview of the default tombstone object lifetime in Microsoft Windows 2000 Active Directory. It covers the specific default duration set by the operating system, the role tombstones play in multi-master replication, and the operational implications this setting has on Active Directory backup and restore procedures.

In Microsoft Windows 2000 Active Directory, the default tombstone object lifetime is 60 days.

When an object—such as a user account, computer, or group—is deleted from Active Directory, the system does not immediately purge it from the database. Instead, the object is converted into a "tombstone." During this process, most of the object's attributes are stripped away, the isDeleted attribute is set to TRUE, and the object is moved to a hidden container named CN=Deleted Objects.

The primary purpose of a tombstone is to ensure that the deletion replicates across all domain controllers in the forest. Because Active Directory uses a multi-master replication model, domain controllers must receive the tombstone record to recognize that the item has been removed. Without this mechanism, an offline or lagging domain controller might treat an absent object as missing and attempt to replicate it back into the directory.

After the 60-day tombstone lifetime expires, an automated process called garbage collection runs on each domain controller (by default, every 12 hours) and permanently removes the tombstoned objects from the database (ntds.dit).

The tombstone lifetime also establishes the maximum supported age for Active Directory system state backups. In a Windows 2000 environment, any backup older than 60 days is considered invalid. Restoring a domain controller from a backup older than the tombstone lifetime can reintroduce deleted items into the directory as "lingering objects," which can cause replication failures and data inconsistency.

The tombstone lifetime is an enterprise-wide setting stored in the Configuration partition. It is defined by the tombstoneLifetime attribute located on the CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=<ForestRoot> object and can be modified using tools such as ADSI Edit if an organization requires a different retention period.