Finding and modifying Active Directory TombStone lifetime


When an Active Directory object is deleted, by default, the object goes in “TombStone” for 180 days. That delay is configurable using ADSIEdit :


You can modify that value by clicking on “Edit”.

You’ll find that object in :
“CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,<Forest DN>”

You can also do that with PowerShell:

$dse = [adsi]“LDAP://RootDSE”
([ADSI]"LDAP://cn=directory service,cn=windows nt,cn=services,$ConfPart").tombstoneLifetime

Leave a Reply