Well the whenChanged attribute of the tombstone should be the date and time the object was deleted.
joe [Thu 12/09/2004 13:06:47.35] F:\DEV\cpp\AdFind>adfind -showdel -default -f "&(objectclass=user)(name=bob*)(isdeleted=TRUE)" whenchanged AdFind V01.25.00cpp ALPHA Joe Richards ([EMAIL PROTECTED]) December 2004 Using server: 2k3dc01.joe.com Directory: Windows Server 2003 Base DN: DC=joe,DC=com dn:CN=bobuserdeny\0ADEL:4d51d923-3267-434d-a0f9-57020ff59767,CN=Deleted Objects,DC=joe,DC=com >whenChanged: 20041202144652.0Z dn:CN=bobuserDENY\0ADEL:9c7756a5-73b1-4f7b-91ea-5804ce94798e,CN=Deleted Objects,DC=joe,DC=com >whenChanged: 20041202143731.0Z 2 Objects returned The command completed successfully. [Thu 12/09/2004 13:07:09.50] F:\DEV\cpp\AdFind> -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Fugleberg, David A Sent: Thursday, December 09, 2004 12:37 PM To: [EMAIL PROTECTED] Subject: [ActiveDir] Finding out when an object was deleted Is there a way to find out exactly when an object was deleted based on its tombstone ? For example, if a user object was deleted can I find it's tombstone somehow and retrieve a timestamp of when it was deleted ? List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
