You can work upon deleted objects in Active Directory using
the information provided here.
When an object is deleted from the directory, Active Directory
performs the following steps:
- The object's isDeleted attribute is set to TRUE. Objects
where isDeleted==TRUE are known as tombstones (not related to IBM® Security Directory Integrator tombstones).
- All attributes that are not needed by Active Directory are removed.
A few key attributes, including objectGUID, objectSID, nTSecurityDescriptor,
and uSNChanged are preserved.
- Moves the tombstone to the Deleted Objects container, which is
a hidden container within the directory partition.
Tombstones or deleted objects are garbage collected some
time after the deletion takes place. Two settings on the "cn=Directory
Service,cn=Windows NT,cn=Service,cn=Configuration,dc=ForestRootDomain"
object determine when and which tombstones are deleted:
- The "garbage collection interval" determines the number of hours
between garbage collection on a domain controller. The default setting
is 12 hours, and the minimum setting is 1 hour.
- The "tombstone lifetime" determines the number of days that tombstones
persist before they are vulnerable to garbage collection. The default
setting is 60 days, and the minimum setting is 2 days.
The above specifics imply the following requirements for
synchronization processes that have to handle deleted objects:
- Synchronization has to be run on intervals shorter than the "tombstone
lifetime" Active Directory setting.
- The objectGUID attribute has to be used for object identifier
during synchronization. The object's distinguishedName attribute
which uniquely identifies the position of an object in the directory
tree, cannot be used because after the object is deleted it changes
its place in the directory tree – it is moved in the Deleted
Objects container and its old distinguished name is irrevocably lost.
The objectGUID attribute is however never changed. When a deleted
object is found during synchronization, a search in the other repository
for an object with the same objectGUID should be made and the
found object should be deleted.