Recipe 16.14 Logging the Number of Expired Tombstone Objects

16.14.1 Problem

You want to log the number of expired tombstone objects that are removed from Active Directory during each garbage-collection cycle.

16.14.2 Solution

16.14.2.1 Using a graphical user interface

Run regedit.exe from the command line or Start Run.
Expand HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Services NTDS Diagnostics.
In the right pane, double-click on 6 Garbage Collection.
For Value data, enter 3.
Click OK.

16.14.2.2 Using a command-line interface

> reg add HKLM\System\CurrentControlSet\Services\NTDS\Diagnostics /v "6 Garbage[RETURN] 
Collection" /t REG_DWORD /d 3

16.14.2.3 Using VBScript

' This code enables garbage collection logging.
' ------ SCRIPT CONFIGURATION ------
strDCName = "<DomainControllerName>"
intValue = 3  
' ------ END CONFIGURATION ---------

const HKLM = &H80000002
strNTDSReg = "SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics"
set objReg = GetObject("winmgmts:\\" & strDCName & "\root\default:StdRegProv")
objReg.SetDWORDValue HKLM, strNTDSReg, "6 Garbage Collection," intValue
WScript.Echo "Garbage Collection logging enabled"

16.14.3 Discussion

Here is a sample event that is logged when the 6 Garbage Collection diagnostics logging level is set to 3 or higher:

Event Type:        Information
Event Source:        NTDS General
Event Category:        Garbage Collection 
Event ID:        1006
Date:                6/24/2003
Time:                11:29:31 AM
User:                NT AUTHORITY\ANONYMOUS LOGON
Computer:        DC1
Description:
Internal event: Finished removing deleted objects that have expired (garbage 
collection). Number of expired deleted objects that have been removed: 229.