I have two Windows Server 2008 R2 domain servers located in two physical locations connected via a VPN. They are functioning normally and syncing across the VPN. However, I intend to disable the VPN while I trace and fix extremely slow Internet access at one of the locations. This may take two or three weeks to allow time to monitor the network.

Am I going to have serious AD issues when I reconnect these two servers? I've never disconnected the servers for that long before and don't know what to expect.


1 Answer 1


Read up on Tombstone in Active Directory. If you left the defaults alone in your GPO, then you can break sync for up to 60 days* without tombstoning your DCs.

  • (or 120 days, depending on the version of Windows that you built your domain with) (thanks Joe!)
  • 6
    If the domain was created with W2K8 R2 (or 2K8 or 2K3 SP1, but not 2K3 R2) then the tombstone lifetime should be 180 days.
    – joeqwerty
    Commented Feb 14, 2013 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .