📚 AD Summer Workbook Day 22: AD dynamic objects
The concept of dynamic objects has been around since Windows Server 2003, but it remains relatively underused.
A dynamic object is an AD object associated with a Time-to-Live (TTL) value. The lifespan of an object is set upon its creation and can be modified. The TTL is automatically decremented, and upon its expiration, the dynamic object is deleted.
⚠️ To be very precise: the object is not necessarily deleted the moment the TTL reaches zero, as there are considerations for replication, garbage collection, etc. I won't go into these details in this overview.
🔺 Default TTL Configuration: CN=DirectoryService,CN=WindowsNT,CN=Services,CN=Configuration,DC=X has the multi-valued attribute ms-DS-Other-Settings containing:
- DynamicObjectDefaultTTLSeconds = Default TTL for dynamic objects (default is 24 hours = 86400 seconds)
- DynamicObjectMinTTLSeconds = Minimum TTL for dynamic objects (default is 15 minutes = 900 seconds)
🔺 Important Attributes:
ObjectClass:
- dynamicObject
- as well as a class defining the base object (user, group, etc.)
entryTTL:
- indicates the remaining time before deletion (in seconds). Decreases every second.
- can be modified. If the entered value is less than 𝘋𝘺𝘯𝘢𝘮𝘪𝘤𝘖𝘣𝘫𝘦𝘤𝘵𝘔𝘪𝘯𝘛𝘛𝘓𝘚𝘦𝘤𝘰𝘯𝘥𝘴, then the value will be that of 𝘋𝘺𝘯𝘢𝘮𝘪𝘤𝘖𝘣𝘫𝘦𝘤𝘵𝘔𝘪𝘯𝘛𝘛𝘓𝘚𝘦𝘤𝘰𝘯𝘥𝘴.
msDS-Entry-Time-To-Die:
- the date when the object will be deleted.
- it is the current date entryTTL.
- read-only
♻️ Dynamic Objects and AD Recycle Bin:
When a dynamic object expires, it is completely erased, leaving no trace in the AD Recycle Bin.
If you manually delete the dynamic object before its expiration, it will go into the AD Recycle Bin but will disappear from the bin at the initial expiration date.
🆕 Creating a Dynamic AD Object:
To create a dynamic object, you can't use the AD console, but you can use PowerShell, LDAP, or AD Explorer (see day 21).
A method for creating one is presented on my blog:
itpro-tips.com/creating-dyna…
🔍 To find the dynamic objects currently in your AD: Get-ADObject -LDAPFilter '(ObjectClass=dynamicObject)'
📅 Tune in tomorrow for the next chapter of our
#ADSummerWorkBook!
#Microsoft #ActiveDirectory