Recipe 3.16 Cleaning Up Distributed Link Tracking Objects

3.16.1 Problem

You want to make sure the Distributed Link Tracking (DLT) service is disabled and all DLT objects are removed from Active Directory. The Distributed Link Tracking Server service is used to track links to files on NTFS partitions. If a file that has a shortcut to it is renamed or moved, Windows uses the DLT service to find the file when the shortcut is opened. Most organizations are unaware this service even exists, but yet it can populate thousands of objects in Active Directory. Unless you are actively using the functionality of the DLT service, it is recommended that you disable it.

3.16.2 Solution

If you upgrade a Windows 2000 domain controller to Windows Server 2003, the DLT Server service is stopped and set to disabled. A new install of Windows Server 2003 also has the service stopped and set to disabled. But the DLT Server service on Windows 2000 domain controllers is enabled by default. Unless you need it, you should stop the service and disable it on all of your domain controllers.

Next, you'll need to remove any DLT objects (linkTrackVolEntry and linkTrackOMTEntry) from Active Directory. Since there can be hundreds of thousands of DLT objects, you will probably want to stagger the deletion of those objects. The script in MS KB 315229 (dltpurge.vbs) can delete DLT objects over a period of time instead of all at once. Here is an example of running the dltpurge.vbs script against the dc1 domain controller in the rallencorp.com domain:

> cscript dltpurge.vbs -s dc1 -d dc=rallencorp,dc=com

3.16.3 Discussion

DLT consists of a client and server service. The server service runs on domain controllers and the client service can run on any Windows 2000 or later machine. The server service stores data in Active Directory in the form of linkTrackVolEntry and linkTrackOMTEntry objects, which are used to track the names and locations of files on NTFS partitions. The cn=ObjectMoveTable,cn=FileLinks,cn=System,<DomainDN> container stores linkTrackOMTEntry objects that contain information about files that have been moved on computers in the domain. The cn=VolumeTable,cn=FileLinks,cn=System,<DomainDN> container stores linkTrackVolEntry objects that represent NTFS volumes on computers in the domain.

Over time, the number of DLT objects can grow substantially. Even though those objects do not take up much space, if you are not actively taking advantage of this service, you should consider disabling it and removing all DLT objects from Active Directory. If you remove a lot of DLT objects, you should determine how much space you can reclaim on the disk of the domain controllers by performing an offline defrag. See Recipe 16.12 for more information.

3.16.4 See Also

MS KB 232122 (Performing Offline Defragmentation of the Active Directory Database), MS KB 312403 (Distributed Link Tracking on Windows-Based Domain Controllers), and MS KB 315229 (Text Version of Dltpurge.vbs for Microsoft Knowledge Base Article Q312403)