Active Directory Deleted Objects

All Active Directory content is stored in the form of objects within directory partitions, and every object is an instance of a specific Active Directory Schema class.

An Active Directory object comes into existence either when Active Directory is installed, or when it is created by an IT administrator or an application. When it is no longer needed, an object can be deleted by an IT administrator or an application. When an object is deleted, it is first logically deleted for a specific interval of time to allow replication of the deletion to occur, and after this time has elapsed it is physically deleted.

A logically deleted Active Directory object is referred to as a Tombstone, and all tombstones reside in the Deleted Objects container in Active Directory.

All logically deleted Active Directory object remain in the Tombstone state for a specific (configurable) period, referred to as Tombstone Lifetime, and after the expiration of this time, they are physically deleted from the partition. This physical deletion process is known as Garbage Collection and it is performed locally on every Domain Controller by a background process called the Garbage Collector.

The Deleted Objects Container and its contents are hidden by default, and require special permissions to view. By default, only the System account and members of the Administrators group can view the contents of this container. Administrators however can configure permissions on this container to enable other users or applications that might have a need to view Deleted Objects in Active Directory, to do so.

IT administrators who wish to query Active Directory to obtain a list of deleted objects should use the Object Identifier Control (1.2.840.113556.1.4.417) also known as the Show Deleted Object control.

IT administrators can also use Gold Finger, a free Active Directory Reporting Tool from Paramount Defenses Inc, a valued Microsoft partner, to instantly generate numerous deleted object and true last logon reports.