HP UX Red Hat Direry Server Software manual Resurrecting Entries

Chapter 19. Synchronizing Red Hat Directory Server with Microsoft Active Directory

deleted if the deleted entry has the ntUserDeleteAccount or ntGroupDeleteAccount attribute set to true.

NOTE

When a Directory Server entry is synchronized over to Active Directory for the first time, Active Directory automatically assigns it a unique ID. At the next synchronization interval, the unique ID is sychronized back to the Directory Server entry and stored as the ntUniqueId attribute. If the Directory Server entry is deleted on Active Directory before the unique ID is synchronized back to Directory Server, the entry will not be deleted on Directory Server. Directory Server uses the ntUniqueId attribute to identify and synchronize changes made on Active Directory to the corresponding Directory Server entry; without that attribute, Directory Server will not recognize the deletion.

To delete the entry on Active Directory and then synchronize the deletion over to Directory Server, wait five minutes so that the ntUniqueId attribute is synchronized, and then delete the entry.

3.4. Resurrecting Entries

It is possible to add deleted entries back in Directory Server; the deleted entries are called tombstone entries. When a deleted entry which was synched between Directory Server and Active Directory is re-added to Directory Server, the resurrected Directory Server has all of its original attributes and values. This is called tombstone reanimation. The resurrected entry includes the original ntUniqueId attribute which was used to synchronize the entries, which signals to the Active Directory server that this new entry is a tombstone entry. The way that tombstone entries are handled is different between Windows Server 2000 and Windows Server 2003:

•On Windows 2000, Active Directory creates a new entry with a new unique ID; this new ID is synched back to the Directory Server entry.

•On Windows 2003, Active Directory resurrects the old entry and preserves the original unique ID for the entry.

For Active Directory entries on both on Windows 2000 and 2003, when the tombstone entry is resurrected on Directory Server, all of the attributes of the original Directory Server are retained and are still included in the resurrected Active Directory entry.

3.5. Manually Updating and Resynchronizing Entries

Synchronization occurs every five minutes. However, an incremental update can be done manually if there are changes that need synchronized immediately.

532