Tombstone lifetime 2

[pinkpanther56]

Can someone tell me how to find the Tombstone lifetime for my domain. I have updated our server 2003 domain to 2008 and would like to find out how what the Tombstone now is.

I will be using a couple of virtual domain controllers (I also have a physical box still) I aim to take a copy of the VM's every couple of months in case they need to be restored but I need to make sure that I don't exceed the tombstone lifetime.

Thanks for any input.

 

[IllogicallyLogical]

- Changing the Tombstone Lifetime Attribute in Active Directory

http://www.petri.co.il/changing_the_tombstone_lifetime_windows_ad.htm

You can check your tombstone lifetime attribute by using the following command:

dsquery * " cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration,dc=" -scope base -attr tombstonelifetime

Joey
CCNA, MCSA 2003, MCP, A+, Network+, Wireless#

 

[pagy]

I will be using a couple of virtual domain controllers (I also have a physical box still) I aim to take a copy of the VM's every couple of months in case they need to be restored

Don't restore a DC from a snapshot/copy, you'll end up with USN rollbacks, which are not fun to deal with.

Back the domain controllers up with your preferred backup software or use Windows Backup.

Paul
MCTS: Exchange 2007, Configuration
MCSA:2003
MCSE:2003
MCITP:Enterprise Administrator

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

 

[pinkpanther56]

@ pagy - Ok so to restore a DC I would need to restore the VM offline then restore a recent system state then bring it back up?


@ IllogicallyLogical - i've checked and it says <Not Set> so as the forest was created on server 2003 SP0 it should be 60 days, can I just edit this value if I wish to extend the lifetime?

Thanks.

 

[IllogicallyLogical]

Yes, the <not set> value would indicate that the tombstone attribute is set to default. Since the forest was created on a Windows Server 2003 machine with no service pack, the default would be 60 days. If you wish to extend the lifetime, just follow the documentation in the link I provided earlier. In accordance with pagy's post about proper backup and restore methods of Active Directory and running Active Directory in a virtualized environment, I am linking some informational documents that will be of help.

- Determine the tombstone lifetime for the forest

http://technet.microsoft.com/en-us/library/cc784932(WS.10).aspx

- Considerations when hosting Active Directory domain controller in virtual hosting environments

http://support.microsoft.com/kb/888794

- How to detect and recover from a USN rollback in Windows Server 2003

http://support.microsoft.com/kb/875495

- Administering Active Directory Backup and Restore

http://technet.microsoft.com/en-us/library/cc740010(WS.10).aspx

Joey
CCNA, MCSA 2003, MCP, A+, Network+, Wireless#

 

[pinkpanther56]

Reading those articles it seems that i'm fine to restore a backed up VM DC as long as it is still within the tombstone lifetime. Correct?

 

[pinkpanther56]

Correct that, I can restore the VM offline then restore a recent system state then bring it back up.