joeware - never stop exploring... :)

There is an article on TechNet about the forest’s tombstone lifetime for Active Directory (http://technet.microsoft.com/en-us/library/cc784932(WS.10).aspx) that was discussed on an internal MSFT DS Team / MSFT MVP email list. The discussion pointed out that there is a little confusion around the article.

Specifically the confusion can come up around step 8

Note the value in the Value column. If the value is <not set>, the default value is in effect as follows:

• On a domain controller in a forest that was created on a domain controller running Windows Server 2003 with Service Pack 1 (SP1), Windows Server 2003 with Service Pack 2 (SP2), Windows Server 2008, or Windows Server 2008 R2, the default value is 180 days.
• On a domain controller in a forest that was created on a domain controller running Windows 2000 Server, Windows Server 2003, or Windows Server 2003 R2, the default value is 60 days.

The question came up… and a good question I might add… “What if you don’t know what version of the OS was used to initially build the forest?”

If this confusion exists for Directory Service MVPs, then it probably exists for some other folks as well.

There is a very easy (for now) way to ascertain what the tombstone lifetime is.

1. Run the command “adfind –sc policies”
2. Read the line that starts with >tombstoneLifetime:
3. If the line exists, the value listed is your tombstone lifetime in days. If the line doesn’t exist, the tombstone lifetime is 60 days.

But joe, doesn’t the OS version matter? No. The reason it doesn’t matter is that the default didn’t change in the source code for the different OS versions. What changed was a line in a file called schema.ini which sets the value of tombstoneLifetime to whatever other value so if the value isn’t set it is the AD default 60 days.

The section of the schema.ini file we are talking about is

; Explict TSL default set in W2K3 SP1 to increase shelf-life of backups and allow longer
; disconnection times.
tombstoneLifetime=180

    joe

I have posted what I expect to be the final AdFind and AdMod beta before final release.

http://www.joeware.net/downloads/beta/adfindmod_beta.zip

I am shooting for a mid-February release.

In the last 10 days most of the updates are in AdFind. Lots of misc shortcut bug fixes. Added some additional attribute decodes. One big item is that I added digest authentication for both utilities (-digest) as that has been missing.

   joe

Just don’t do it.

See http://technet.microsoft.com/en-us/library/ee424329(WS.10).aspx

From the article

When a company acquires another company, business unit, or product line, the purchasing company may also want to acquire corresponding IT assets from the seller. Specifically, the buyer may want to acquire some or all of the domain controllers that host the user accounts, computer accounts, or security groups that correspond to the business assets that are to be purchased. The only supported methods for the buyer to acquire the IT assets that are stored in the seller’s Active Directory forest are as follows:

1. Acquire the only instance of the forest, including all domain controllers and directory data in the seller’s entire forest.
2. Migrate the needed directory data from the seller’s forest or domains to one or more of the buyer’s domains. The target for such a migration may be an entirely new forest or one or more existing domains that are already deployed in the buyer’s forest. We recommend that you migrate the directory data without security identifier (SID) history. If you migrate the directory data with SID history, information about the seller’s forest will be retained in the new forest of the buyer. For more information about migrating directory data without SID history, see Migrating Accounts Without Using SID History (http://go.microsoft.com/fwlink/?LinkId=113694).

This isn’t just a so-so recommendation that may or may not be right for your specific circumstance (sort of like the disk configuration guidelines), this is a hard and fast rule. Seriously bad things can happen and likely will if you mess around with it. If you do it and run into issues, the DS Team at Microsoft will walk away shaking their head[1].

    joe

[1] They didn’t tell me this, I am just guessing based on my conversations with them.

DON’T CLONE