Lingering Objects

When restoring a backup file, Active Directory generally requires that the backup file be
no more than 180 days old. (The limit is 60 days if the AD forest was originally created
with Windows Server 2000.) If attempt to you restore an backup that is expired, you
may encounter problems due to “lingering objects”.

What Are Lingering Objects?

A lingering object is a deleted AD object that re-appears (“lingers”) on the restored
domain controller (DC) in its local copy of Active Directory. This can happen if, after the
backup was made, the object was deleted on another DC more than than 180 days ago.
When a DC deletes an object it replaces the object with a tombstone object. The
tombstone object is a placeholder that represents the deleted object. When replication
occurs, the tombstone object is transmitted to the other DCs, which causes them to
delete the AD object as well.

Tombstone objects are kept for 180 days, after which they are garbage-collected and
removed.

If a DC is restored from a backup that contains an object deleted elsewhere, the object
will re-appear on the restored DC. Because the tombstone object on the other DCs has
been removed, the restored DC will not receive the tombstone object (via replication),
and so it will never be notified of the deletion. The deleted object will “linger” in the
restored local copy of Active Directory.

How to Remove Lingering Objects

Windows Server 2003 and 2008 have the ability to manually remove lingering objects
using the console utility console utility REPADMIN.EXE. REPADMIN.EXE can be found
in the Windows Server 2003 Support Tools, located on the Windows 2003 Server
CD/DVD. (It is standard on Windows Server 2008.) Use the option
/removelingeringobjects. See below for more information.