Testing the Process
To determine how much disk space Ntdsutil could reclaim, I built a standalone test server running Win2K Advanced Server Service Pack 3 (SP3) in an isolated network. After running Dcpromo and installing AD, I wrote a Visual Basic (VB) application that added 25,000 users and 25,000 groups to AD. After the addition of these 50,000 objects, ntds.dit grew from 10.256MB to 221.1MB. I ran Ntdsutil, which decreased ntds.dit to 184.6MB. I then deleted the 50,000 objects.
When you delete an object in AD, the object isn't truly deleted but is simply marked for deletion at a later date. This process is called tombstoning, and the default tombstone-lifetime setting is 30 days. Objects are tombstoned rather than immediately deleted to ensure that the deletion has sufficient time to replicate throughout the forest. The garbage-collection process scans for and permanently deletes any object with an expired tombstone lifetime. To speed up the deletion process, I used ADSI Edit (a Win2K Support Tool, which you can install from the Win2K CD-ROM's \support\tools directory) to set the garbage-collection attribute (garbageCollPeriod) to 1 hour, advanced the date on my test server ahead by 30 days, and rebooted. (Note that in a production environment, you should never advance the system time to force deletion of tombstoned objects. Doing so can result in problems with replication, backups, and Kerberos ticket lifetimes.)
I let the server run overnight so that AD would perform a regular online defragmentation. The next morning, I ran Ntdsutil again. The database file shrank back to the default size of 10.256MB.
Keeping AD Healthy
Given all the day-to-day tasks that occur in AD (e.g., adding users, deleting users, modifying group membership), you can see how AD can become fragmented within a short period. Proper monitoring and preventive maintenance of AD can help ensure that AD functions at an optimum level and is important to the overall health of your Win2K network. Win2K doesn't offer any built-in tools to perform these crucial tasks natively, but several third-party products, such as NetIQ's AppManager Suite or NetPro's DirectoryAnalyzer, are available. For more information about monitoring and maintaining AD and the tools you can use to do so, see "Best Systems Management Products," September 15, 2002, http://www.winnetmag.com, InstantDoc ID 26316; "Practice Proactive AD Maintenance," August 2002, InstantDoc ID 25637; "DirectoryAnalyzer 1.04," November 2000, InstantDoc ID 15725; and "Monitoring Your AD-Enabled Network," September 2000, InstantDoc ID 9645.
End of Article
Prev. page
1
2
[3]
next page -->
