Discovered Domain Controller Tombstoning is a thing! what's yours set to?

[Jaan]

I was testing our backups as you do, with the servers and restore points randomly selected. In this instance, the two domain controllers were selected and their restore points of approx 6 months ago. We'd of course select the most recent restore point if this was a "real" restore.

 

One of these DCs is a physical the other a virtual. We have a old retired hyper-v server we use to test our restores and recoveries to. Both Dcs were restored to this as virtual servers.

 

The restore went fine, but both DCs failed to boot displaying BSOD. This confused me as a month before we did a full disaster recovery and everything booted and was fine.

 

after doing research, i discovered the BSOD was related to DC "Tombstoning" which was a totally new thing to me!. Our DC Tombstoning is set to which apparently is from server 2003 days. Our domain is 23 years old then!

 

I found this article which explains how to check and change you're tombstoning period. It recommends 730days (2 years).

 

https://helpcenter.netwrix.com/bundle/Auditor_10.0/page/Content/Configure_IT_Infrastructure/AD/AD_Tombstone.htm

 

I was just curious if any of you guys have changed yours away from the default value, and if so..... to what.

 

I stepped into the network manager role here 4 years ago and have been on this site in some technical capacity for 15 years approx. I love that i still learn new things every day!

[robintech]

not sure what ours is set to so probably a good idea to find out

 

Edit: 180 days for ours

 

$RootDomain = (Get-ADForest).RootDomain
$DomainDN = (Get-ADDomain -Identity $RootDomain).DistinguishedName
Get-ADObject "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$DomainDN" -Properties tombstoneLifetime |Format-List tombstoneLifetime,DistinguishedName

 

https://azurecloudai.blog/2021/08/12/field-notes-active-directory-tombstone-lifetime/

Edited December 13, 2023 by ittech2342323

[HPlum78]

MS recommend that its set to 180 days, interesting comment on the age of your domain 23 years! we here had the oldest Domain that MS knew of and was built on pre production server 2000 (I think MS said it was 2 months older than their own domain) we had to get out of band schema updates. We migrated a fair few years ago now to a new domain built on server 2008 as none of us wanted to carry on with the out of band schema updates!

[Jaan]

We've always done in place domain updates. I've been here 15 years and remember running server 2003........ currently looking to jump from 2019 to 22 so it makes sense that it's just evolved over the years.

 

I remember having 15+ physical servers with individual roles, going it Hyper-v replica nodes, to now having a 3 node S2D cluster with 15+ servers with individual roles

[HPlum78]

I dont know how busy your domain is but interested to see how much of the RID pool is left?

 

Dcdiag.exe /TEST:RidManager /v | find /i "Available RID Pool for the Domain"

 

if your not running that from a DC then you need to add the /s:

Dcdiag.exe /s: /TEST:RidManager /v | find /i "Available RID Pool for the Domain"

 

We do in-place now the migration was to get us out of a very unique problem....

 

and here is the reason we ended up in that very unique position:

 

https://www.oreilly.com/library/view/active-directory-second/0596004664/pr01s05.html

Edited December 13, 2023 by HPlum78

[Jaan]

I dont know how busy your domain is but interested to see how much of the RID pool is left?

 

Dcdiag.exe /TEST:RidManager /v | find /i "Available RID Pool for the Domain"

 

if your not running that from a DC then you need to add the /s:

Dcdiag.exe /s: /TEST:RidManager /v | find /i "Available RID Pool for the Domain"

 

We do in-place now the migration was to get us out of a very unique problem....

 

Ok now i'm scared.....

[Jaan]

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/managing-rid-issuance

 

i get this......

 

* Available RID Pool for the Domain is 32103 to 1073741823

[HPlum78]

Wow for an older Domain that's not burned through the RID pool at all... our domain is no where near 23 years old and we have burned through more than you have, that said our Domain is clearly way busier than most...

[Jobos]

We have DC Tombstoning set to as well but the domain was created in November 2003 so sort of expected that but the available RID Pool for the domain is 11605 to 1073741823 so does that mean we are going to be trouble real soon?

[robintech]

I think is the same as 60 days and your RID pool has only used 11605 out of the 1073741823 so nowhere near in trouble

[Jobos]

Thanks. I had it the other way round thinking just 11k left.