How to Check Tombstone Lifetime of Active Directory

In this guide, I’ll show two options on how to check the Tombstone Lifetime in Active Directory.

Option 1. Check Tombstone Lifetime using PowerShell

Use the below PowerShell command to check the Tombstone lifetime in Active Directory. You will need to update the distinguishedName to match your domain.

(get-adobject “cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration,DC=ad,DC=activedirectorypro,DC=com” -properties “tombstonelifetime”).tombstonelifetime
powershell check active directory tombstone lifetime

You can see in the screenshot above my Tomestone lifetime is 180 days.

You can find your distinguishedName with this command.

Get-ADRootDSE | select defaultNamingContext
powershell get root of the domain

Update the section in red with your domains distinguishedName.

update root domain

Option 2. Check Tombstone Lifetime using ADSI Edit

Step 1. Open ADSI Edit

Step 2. Right on ADSEI Edit and select “Connect to”

adsi edit connect to

Step 3. Select “Configuration” from the drop down and then click “OK”.

adsi edit select configuration

Step 4. Expand the following:

  • CN=Configuration,(your domain)
  • CN=Services
  • CN=Windows NT
  • CN=Directory Service

Then right click on CN=Directory Service and select “Properties”

adsi expand containers

Scroll down and check the value of “tombstoneLifetime”.

adsi tomestonelifetime

Leave a Comment