Lingering Objects

When restoring a backup file, Active Directory generally requires that the backup file be no more than 60 days old. (The limit is 180 days if the AD forest was created by Windows Server 2003.) If attempt to you restore an backup that is expired, you may encounter problems due to “lingering objects”.

What Are Lingering Objects?

When you restore AD from an expired backup, a lingering object is a deleted AD object that re-appears (“lingers”) on the restored domain controller (DC) in its local copy of Active Directory. This can happen if, after the backup was made, the object was deleted on another DC more than than 60 (or 180) days ago.

When a DC deletes an object it replaces the object with a tombstone object. The tombstone object is a placeholder that represents the deleted object. When replication occurs, the tombstone object is transmitted to the other DCs, which causes them to delete the AD object as well.

Tombstone objects are kept for 60 (or 180) days, after which they are garbage-collected and removed.

If a DC is restored from a backup that contains an object deleted elsewhere, the object will re-appear on the restored DC. Because the tombstone object on the other DCs has been removed, the restored DC will not receive the tombstone object (via replication), and so it will never be notified of the deletion. The deleted object will “linger” in the restored local copy of Active Directory.

How to Remove Lingering Objects

Windows Server 2003 has the ability to manually remove lingering objects using the repadmin console utility from the Windows Server 2003 Support Tools, located on the Windows Server CD. Use the option /removelingeringobjects. See below for more information.

For More Information

For more information on lingering objects and how to remove them, see Outdated Active Directory objects generate event ID 1988 in Windows Server 2003 and the topic “Lingering Object Removal” in the TechNet white paper How the Active Directory Replication Model Works.