Recycling Active Directory Trash with the AD Recycle Bin

Hopefully some of you have been playing with Server 2008 R2 while it has been in Beta.  One of the features I’m looking forward to most is the AD Recycle Bin.  Yes you heard me correct.  We now have an easy method for restoring accidently deleted objects. 

In the past our only recovery method out of the box was to perform an authoritative restore of an object. That method had several issues that always rubbed me the wrong way.  First you had to be in Directory Services Restore Mode (DRSM).  And ever since Server 2003 we could use tombstone reanimation but that removed most of the non-link-valued attributes.  This lead to additional work after the restore. The default tombstone lifetime was 180 days with Server 2003 and 2008.

You are probably already familiar with tombstones and the garbage collection process.  If not read Gil’s excellent article on that here.  With Server 2008 R2 you will need to now become aware of Deleted Object and Recycled Object.  The first thing to realize here is that the AD Recycle Bin is not enabled by default with Server 2008 R2.  The following steps/requirements must first be met:

  1. Raise the Forest Functional Level to Server 2008 R2
  2. Enable AD Recycle Bin (my example uses PowerShell…get use to it now)
    1. Enable-ADOptionalFeature –Identity “CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration, DC=AdminPrep,DC=com” –Scope ForestOrConfigurationSet –Target “AdminPrep.com”
    2. Just make sure to replace AdminPrep with your domain

Now when an object is deleted it is not marked for tombstone it is marked as deleted.  It places the object in the Deleted Objects container which is hidden but can be located here – CN=Deleted Objects.  When you want to restore an object there are two methods that I”m aware of, one using PowerShell and the other using LDP.

Using LDP:

  1. Using elevated credentials, open LDP by typing ldp.exe from the Run Dialog box
  2. Click Connections and select Connect and then go back and select Bind
  3. Navigate to the CN=Deleted Objects
  4. Find the object you wish to restore and right-click it and select Modify
  5. In the Modify dialog box:
    1. In Edit Entry Attribute, type isDeleted
    2. Leave the Values box empty
    3. Under Operation, click Delete,and then click Enter
    4. In Edit Entry Attribute,type distinguishedName
    5. In Values, type the original distinguished name (also known as DN) of this Active Directory object
    6. Under Operation, click Replace
    7. Make sure that the Extended check box is selected, click Enter, and then click Run

To restore an object using PowerShell you must use the Get-ADObject and Restore-ADObject cmdlets.  Using PowerShell:

  1. Open the Active Directory PowerShell command Prompt and use the following syntax:
    1. Get-ADObject-Filter {String} -IncludeDeletedObjects | Restore-ADObject
  2. Here is an example of restoring a deleted user account named Brian:
    1. Get-ADObject -Filter {displayName -eq “Brian”} -IncludeDeletedObjects | Restore-ADObject

When restoring multiple items that may be linked (OU or Group that contains Users) you will want to start at the highest level.

An object can only be restored using those methods if it is still within the Deleted Object Lifetime.  The attribute is msDS-deletedObjectLifetime and if you look it up it will have a null value which the default time is 180 days.

Here is a look at what AD Recycle Bin looks like visually

3 Comments

  1. Jeffery Land says:

    I did not know about that coming in R2. I really need to look into R2 since I”ve been studying a lot of Server 2008 lately. Hopefully my next job is on 2008 or that the company will be migrating to it soon.

  2. Wayne Gillian says:

    Some 3rd party solutions like Active adminsitrator can provide even more powerful ways to do active directory restores.

    The tool can recover active directory objects, group policies, objects passwords as well as security separate from objects in a very intuitive way.

    http://www.scriptlogic.com/products/activeadmin

  3. Lepide Active Directory Management and Reporting (LADMR) software is a proficient Active Directory management tool that can relieve administrators from the use of complex ADAM tools and command line utilities. This software has been developed to manage AD objects including users, user properties, general attributes, and other non user objects conveniently without any scope of error.
    The product can easily recover the deleted objects and group policies.

    http://www.lepide.com/active-directory-management-and-reporting.html

Leave a comment