Active directory garbage collection causing CPU overload

For Active Directory database garbage collection on domain controllers, the supported way to adjust the schedule is to change the garbageCollPeriod attribute in the enterprise-wide Directory Service configuration object.

• Default interval: 12 hours
• Minimum: 1 hour
• Maximum: 168 hours
• Where to change it: CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=CONTOSO,DC=COM
• Supported tools: Adsiedit.msc, Ldp.exe, or ADSI scripts

A safer tuning approach is:

1. Change only the garbage collection interval first using garbageCollPeriod.
2. Keep changes modest and validate DC behavior after each adjustment.
3. Do not rely on logging changes as the primary fix for CPU spikes. The documented issue for DC slowdowns during garbage collection is tied to Active Directory database behavior, including version store exhaustion and inconsistent objects/reference phantoms.
4. If the DC becomes slow or unresponsive during garbage collection and logs show errors such as 623, 1519, 1479, or error 8573, the documented workaround is to increase the Active Directory version store size.

If version store tuning is required, the documented workaround is to change this registry value:

• Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
• Name: EDB max ver pages (increment over the minimum)
• Type: REG_DWORD

Important cautions:

• Registry changes are risky and can affect LSASS memory usage.
• Values below 6400 have no effect; 6400 is the default and minimum.
• Increase in roughly 50 MB increments.
• Do not set arbitrarily high values, especially on x86 systems, because LSASS can run out of memory for other tasks.
• If garbage collection still does not complete successfully at 19200, the documented guidance is to contact Microsoft Support.
• Increasing version storage is only a temporary workaround; the issue can recur after a tombstone lifetime interval or when the affected objects are scanned again.

For the underlying cause, the documented problem can be many inconsistent objects or too many reference phantoms. In that case, the recommended path is Microsoft Support assistance to identify and remove those objects.

On defragmentation:

• Online defragmentation runs as part of garbage collection and does not reduce the size of Ntds.dit.
• Offline defragmentation with Ntdsutil.exe does reduce Ntds.dit size, but it requires taking the domain controller offline.

The provided documentation does not give a supported procedure for “fine-tuning logging settings” to reduce this load. The supported tuning that is documented is adjusting garbageCollPeriod, and for the specific slowdown/hang condition, adjusting version store size as a workaround while investigating inconsistent objects or reference phantoms.

References:

• The Active Directory database garbage collection process and calculation of allowed intervals
• The domain controller runs slower or stops responding when the garbage collection process runs