Lingering objects

A lingering object is a deleted AD object that re-appears (“lingers”) on the restored domain controller (DC) in its local copy of Active Directory. This can happen if, after the backup was made, the object was deleted on another DC more than than 180 days ago or after tombstone period expired .

When a DC deletes an object it replaces the object with a tombstone object. The tombstone object is a placeholder that represents the deleted object. When replication occurs, the tombstone object is transmitted to the other DCs, which causes them to delete the AD object as well.

Tombstone objects are kept for 180 days, after which they are garbage-collected and removed.

If a DC is restored from a backup that contains an object deleted elsewhere, the object will re-appear on the restored DC. Because the tombstone object on the other DCs has been removed, the restored DC will not receive the tombstone object (via replication), and so it will never be notified of the deletion. The deleted object will “linger” in the restored local copy of Active Directory.

The presence of lingering objects indicates that at least one DC was not able to replicate changes to other DCs for longer than the tombstone lifetime of the AD forest.this value specifies the length of time that a deleted object will remain in Active Directory before being permanently removed. When the disconnected DC is again able to communicate with another DC in the domain, the two DCs will attempt to replicate changes that have occurred in the meantime. Any objects that have been deleted from one DC but still exist on the other are lingering objects.

When Active Directory detects the presence of a lingering object, NTDS Replication event 1388 or 1988 will be logged in the Directory Service event log of the DC that detects it. 

How to Remove Lingering Objects

The repadmin /removelingeringobjects command can be used to list and/or remove lingering objects from a DC. The command syntax is as follows:

repadmin /removelingeringobjects <lingering_DC_name> <reference_DC_GUID> <dir_partition> [/advisory_mode]

The parameters are defined as follows:

• <lingering_DC_name>: The full DNS name or distinguished name of the DC which is believed to contain lingering objects. The DNS-based GUID of this DC is given in the NTDS Replication event that indicates the presence of lingering objects. This GUID can be resolved to the DC’s name via the DNS console or the Active Directory Sites and Services console.
• <reference_DC_GUID>: The GUID of a DC which contains a valid copy of Active Directory – in other words, one without lingering objects. The GUID of a DC can be determined by running the repadmin /showrepl <dc_name> command.
• <dir_partition>: The distinguished name of the directory partition where lingering objects reside. This is given in the event indicating the presence of lingering objects.
• /advisory_mode: This optional switch instructs the command to check for lingering objects but not remove any that are found. It is generally a good idea to first run the command with the /advisory_mode switch, and if lingering objects are found, run it a second time without this switch.

When the above command is run in advisory mode, the DC containing lingering objects will log NTDS Replication event 1942 in its Directory Service log. The event will indicate the number of lingering objects found. If the command is then run without the /advisory_mode switch, several additional NTDS Replication events are logged during the removal process:

• Event ID 1937 indicates that the removal process has begun.
• There will then be an instance of event ID 1945 for each lingering object. Each event will indicate the specific object being removed.
• Finally, event ID 1939 will indicate that the removal process has completed and give the total number of objects removed.

So, that’s all in this blog. I will meet you soon with next stuff .Have a nice day !!!

Recommended content

RODC Installation Guide- Step by step guide to install read only domain controller

RODC Filtered Attribute Set

Installing and configuring a RODC in Windows Server-2012

How to find the GUID of Domain Controller

Understanding Group Policy Preferences

Group Policy Verification Tool GPOTool Exe

Group Policy Health Check on Specific Domain Controller

Netlogon Folder in Active Directory

Custom Attributes in Active Directory

Tombstone Lifetime of My Active Directory Forest

Computers AD Site From the Command Line

Active Directory Database Integrity

Disabling and Enabling the Outbound Replication

DFS Replication Service Stopped Replication

Strict Replication Consistency

The replication operation failed because of a schema mismatch between the servers involved

Troubleshooting ad replication error 8418 the replication operation failed because of a schema mismatch between the servers

Replication information in txt file

Repadmin Replsummary

Enabling the outbound replication

Guys please don’t forget to like and share the post.Also join our WindowsTechno Community and where you can post your queries/doubts and our experts will address them .

You can also share the feedback on below windows techno email id.

If you have any questions feel free to contact us on admin@windowstechno.com also follow us on facebook@windowstechno to get updates about new blog posts.