Active Directory

LDAP:

LDAP is the directory service protocol that is used to query and update AD.

LDAP naming paths are used to access AD objects and include the following:

Ø  Distinguished names

Ø  Relative Distinguished names

Distinguished name gives the complete path of the object.

E.g. CN=Rama Raju,OU=India,DC=Microsoft,DC=com

Relative Distinguished name is the portion of the distinguished name that uniquely defines the object.

E.g. CN=Rama Raju

Physical and Logical Componets of AD:

Logical components: Domains, OU, Trees & Forest


Physical Components: Domain Controllers & Sites

Tombstone Objects:

The tombstone lifetime in an Active Directory forest determines how long a deleted object - aka a ‘tombstone’ - is retained in Active Directory. The tombstone lifetime is determined by the value of the tombstoneLifetime attribute on the Directory Service object in the configuration directory partition.


Tombstone Lifetime assists in removing objects from replicated servers and preventing restores from reintroducing a deleted object. Actually when an object is deleted from Active Directory, it is not physically removed from the Active Directory for some days. Instead, the Active Directory sets the ‘isDeleted’ attribute of the deleted object to TRUE and move it to a special container called ‘Tombstone’.

• The default Tombstone Life time period is 60 days in Windows Server 2003 
• But the default Tombstone Lifetime period has been changed in Windows Server 2003 SP1and later to 180 days.

The tombstone lifetime attribute remains same on all the domain controllers and it is deleted from all the servers at the same time. This is because the expiration of a tombstone lifetime is based on the time when an object was deleted logically from the Active Directory, rather than the time when it is received as a tombstone on a server through replication.