Hopefully some of you have been playing with Server 2008 R2 while it has been in Beta. One of the features I’m looking forward to most is the AD Recycle Bin. Yes you heard me correct. We now have an easy method for restoring accidently deleted objects.
In the past our only recovery method out of the box was to perform an authoritative restore of an object. That method had several issues that always rubbed me the wrong way. First you had to be in Directory Services Restore Mode (DRSM). And ever since Server 2003 we could use tombstone reanimation but that removed most of the non-link-valued attributes. This lead to additional work after the restore. The default tombstone lifetime was 180 days with Server 2003 and 2008.
You are probably already familiar with tombstones and the garbage collection process. If not read Gil’s excellent article on that here. With Server 2008 R2 you will need to now become aware of Deleted Object and Recycled Object. The first thing to realize here is that the AD Recycle Bin is not enabled by default with Server 2008 R2. The following steps/requirements must first be met:
Now when an object is deleted it is not marked for tombstone it is marked as deleted. It places the object in the Deleted Objects container which is hidden but can be located here – CN=Deleted Objects. When you want to restore an object there are two methods that I”m aware of, one using PowerShell and the other using LDP.
To restore an object using PowerShell you must use the Get-ADObject and Restore-ADObject cmdlets. Using PowerShell:
When restoring multiple items that may be linked (OU or Group that contains Users) you will want to start at the highest level.
An object can only be restored using those methods if it is still within the Deleted Object Lifetime. The attribute is msDS-deletedObjectLifetime and if you look it up it will have a null value which the default time is 180 days.
Here is a look at what AD Recycle Bin looks like visually