AD retention period

Check AD retention tombstone value:

				
					Import-Module ActiveDirectory 

$ADForestconfigurationNamingContext = (Get-ADRootDSE).configurationNamingContext 

$DirectoryServicesConfigPartition = Get-ADObject -Identity "CN=Directory Service,CN=Windows NT,CN=Services,$ADForestconfigurationNamingContext" -Partition $ADForestconfigurationNamingContext -Properties * 

$TombstoneLifetime = $DirectoryServicesConfigPartition.tombstoneLifetime 

Write-Output "Active Directory’s Tombstone Lifetime is set to $TombstoneLifetime days `r "
				
			

If this returns nothing, your AD tomstone retention is default 60 days

Here is a method to change the tomstone value:

				
					Import-Module ActiveDirectory 

$ADForestconfigurationNamingContext = (Get-ADRootDSE).configurationNamingContext 

Set-ADObject -Identity "CN=Directory Service,CN=Windows NT,CN=Services,$ADForestconfigurationNamingContext" -Partition $ADForestconfigurationNamingContext -Replace @{tombstonelifetime='366'}
				
			

More articles