--- title: "Active Directory Recycle Bin: Enable, Manage, and Optimize" description: "Learn how the Active Directory Recycle Bin works, enable it with ADAC and PowerShell, and manage tombstone lifetime." canonical: "https://adamtheautomator.com/active-directory-recycle-bin/" --- # Active Directory Recycle Bin: Enable, Manage, and Optimize > Learn how the Active Directory Recycle Bin works, enable it with ADAC and PowerShell, and manage tombstone lifetime. Source: https://adamtheautomator.com/active-directory-recycle-bin/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Active Directory Recycle Bin: Enable, Manage, and Optimize](https://adamtheautomator.com/wp-content/uploads/2020/10/Active-Directory-Recycle-Bin.png) # Active Directory Recycle Bin: Enable, Manage, and Optimize [![](https://secure.gravatar.com/avatar/f08b754bc0dce1c76685f6afa93185ecfb6f861fd14f993286e06bba69eaeb8b?s=192&d=mm&r=g)Adam Listek](https://adamtheautomator.com/author/alistek/)13 October 20205 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/) Table of Contents * [How Does the Recycle Bin in Active Directory Work?](#h-how-does-the-recycle-bin-in-active-directory-work) * [Logically Deleted Objects](#logically-deleted-objects) * [Tombstone Recycling](#tombstone-recycling) * [Enabling the Recycle Bin with ADAC](#h-enabling-the-recycle-bin-with-adac) * [Enabling the Active Directory Recycle Bin with PowerShell](#enabling-the-active-directory-recycle-bin-with-powershell) * [Recovering Objects with the Active Directory Recycle Bin (ADAC)](#h-recovering-objects-with-the-active-directory-recycle-bin-adac) * [Recovering Objects with the Active Directory Recycle Bin (PowerShell)](#h-recovering-objects-with-the-active-directory-recycle-bin-powershell) * [Emptying the Active Directory Recycle Bin](#h-emptying-the-active-directory-recycle-bin) * [Changing the Tombstone Lifetime](#h-changing-the-tombstone-lifetime) If you’ve accidentally removed an Active Directory user, computer, or OU, did you know you can get it back? If enabled, the Active Directory recycle bin can help you recover that AD object. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** In this article, you’re going to learn how to enable and restore objects in no time with the Active Directory recycle bin! > _If you need a fully-featured service to easily backup and restore Active Directory objects and a whole lot more, check out [Veeam Backup & Replication](https://www.veeam.com/data-protection-virtual-machine.html?utm_campaign=01BR-VAS_Global_EN_0_Custom_Trial_Virtual&utm_source=adamtheautomator.com&utm_medium=dcm&st=pa&ccode=dcmbloggers)._ ## How Does the Recycle Bin in Active Directory Work? When you enable the recycle bin, it tells AD not to remove objects immediately from the AD database. There are two stages that occur when you remove an AD object. ### Logically Deleted Objects The moment you remove an AD object, you can consider that object “logically” deleted. When an object is “logically” deleted, it doesn’t actually get removed from the AD database. Instead, it’s simply hidden and moved to the `CN=Deleted Objects` container and the attribute `isDeleted` is set to `TRUE` on the object. > _The amount of time that a logically deleted object can be recovered is set by the `msDS-deletedObjectLifetime` attribute. The default value is the same number of days as the Tombstone Lifetime which defaults to 180 days._ ### Tombstone Recycling Once the logically deleted object exceeds the deleted object lifetime defined by the _`msDS-deletedObjectLifetime`_ attribute, the object is considered tombstoned. At this point, the object is not recoverable. After the `msDS-deletedObjectLifetime` time has been exceeded, the `isRecycled` attribute is set to `TRUE` and the `isDeleted` attribute remains `TRUE`. The [tombstone lifetime](https://www.windowstechno.com/how-can-i-check-the-tombstone-lifetime-of-my-active-directory-forest/) then begins with a default of 180 days. Once the AD object exceeds the tombstone lifetime, the object is then physically deleted from the database via [garbage collection](https://teckadmin.wordpress.com/2011/04/20/garbage-collection-process-of-active-directory/). ## Enabling the Recycle Bin with ADAC By default, the AD recycle bin isn’t enabled. To use this handy feature, you must manually enable it. Don’t forget until it’s too late! To enable the recycle bin: 1. Navigate to the [Active Directory Administrative Center](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/adac/active-directory-administrative-center) (ADAC) either on your domain-joined workstation or on a domain controller. 2. Click on the domain located on the left-hand side and find the **Tasks** menu on the right-hand side. 3. Click on the **Enable Recycle Bin** option to enable the recycle bin as shown below. ![Enabling the Active Directory Recycle Bin.](https://adamtheautomator.com/wp-content/uploads/2020/10/Untitled-2020-10-10T135534.406.png) Enabling the Active Directory Recycle Bin. ADAC will then prompt with a confirmation to enable the recycle bin. ![Confirmation prompt for the recycle bin.](https://adamtheautomator.com/wp-content/uploads/2020/10/Untitled-2020-10-10T135559.225.png) Confirmation prompt for the recycle bin. Depending on how large your domain is, it may take some time to propagate the settings. ![Confirmation that the process to enable the recycle bin has begun.](https://adamtheautomator.com/wp-content/uploads/2020/10/Untitled-2020-10-10T135633.713.png) Confirmation that the process to enable the recycle bin has begun. After a refresh, you should see that the **Enable Recycle Bin** option is now grayed out. ![Verification that the recycle bin has been enabled.](https://adamtheautomator.com/wp-content/uploads/2020/10/Untitled-2020-10-10T135704.977.png) Verification that the recycle bin has been enabled. ## Enabling the Active Directory Recycle Bin with PowerShell If, for some reason, you need to automate enabling the recycle bin, you can always do so with PowerShell and the `Enable-ADOptionalFeature` cmdlet. Below is a code snippet you can use to enable the recycle bin while in PowerShell. The example below is enabling the recycling bin at the forest level for the ad.lc-test.local forest. ```powershell $Params = @{ "Identity" = 'Recycle Bin Feature' "Scope" = 'ForestOrConfigurationSet' "Target" = 'ad.lc-test.local' } Enable-ADOptionalFeature @Params ``` ## Recovering Objects with the Active Directory Recycle Bin (ADAC) Once you’ve enabled the recycle bin, you can now take advantage of it! Let’s first start by using ADAC. After you’ve removed an object but before the tombstone lifetime expires: 1. Navigate to the **Deleted Objects** container in ADAC. This container holds all of the deleted Active Directory objects. ![Demonstration of the new Deleted Objects OU.](https://adamtheautomator.com/wp-content/uploads/2020/10/Untitled-2020-10-10T135739.742.png) Demonstration of the new Deleted Objects OU. 2\. Next, locate the object to restore. In this case, we are looking for the `TestUser2` object. On the right-hand Tasks menu, there are four options. * **Restore** – Restore the object to its original organizational unit (OU). * **Restore To…** – Instead of restoring the object to the original location, choose a different organizational unit to restore the object to. * **Locate Parent** – This option will take you directly to the organizational unit that the object was contained within. * **Properties** – View very limited properties such as Modified, Created, Object Class, Canonical Name, or Update Sequence Numbers (USN). ![Showing that the TestUser2 is in the Deleted Objects OU.](https://adamtheautomator.com/wp-content/uploads/2020/10/Untitled-2020-10-10T135808.973.png) Showing that the TestUser2 is in the Deleted Objects OU. In this example, we will restore the object to its original organizational unit located in the Users containers. 3\. Clicking on the **Restore** button and as you can see below the object is now back under the Users OU. ![Demonstrating that TestUser2 has been restored.](https://adamtheautomator.com/wp-content/uploads/2020/10/Untitled-2020-10-10T135834.013.png) Demonstrating that TestUser2 has been restored. ## Recovering Objects with the Active Directory Recycle Bin (PowerShell) As useful as that technique, it’s often even easier and more scriptable using PowerShell to do the same tasks as done under the GUI. To restore an AD object with PowerShell: 1. On a domain-joined computer or on a domain controller, open up PowerShell and find a deleted object. Ensure you have the ActiveDirectory module installed. **_Related: [How to Install the Active Directory Module](https://adamtheautomator.com/powershell-import-active-directory/)_** 2\. Locate the objects to delete with the [`Get-ADObject`](https://adamtheautomator.com/get-adobject/ "Get-ADObject") command. **_Related: [Get-ADObject: Reporting on Active Directory with PowerShell](https://adamtheautomator.com/get-adobject/)_** You can find the object a few different ways but always use the `IncludeDeletedObjects` parameter. This parameter is necessary to find all of the objects in the Deleted Objects container. If you run `Get-ADObject` by itself using a broad filter like `-Filter *`, you will see a ton of unnecessary results. To target only those results that should be in the recycle bin you can filter down the objects like so. **_Related: [Learning Active Directory and LDAP Filters in PowerShell](https://adamtheautomator.com/ldap-filter/)_** Instead, craft a filter to find all objects with an isDeleted attribute set to true with an account name containing the string `*DEL:*`. This filter should only returned deleted objects. ```powershell Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*DEL:*"' –IncludeDeletedObjects ``` ![Querying for deleted objects via PowerShell.](https://adamtheautomator.com/wp-content/uploads/2020/10/Untitled-2020-10-10T135933.776.png) Querying for deleted objects via PowerShell. Once you’ve found the objects with `Get-ADObject`, you can now pipe those objects to the `Restore-ADObject` command. ```powershell Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*DEL:*"' –IncludeDeletedObjects | Restore-ADObject ``` Once the restore has (hopefully) occurred, you should then verify the object is back. To do so, run the `Get-ADObject` command again and confirm you no longer see the object returned. If not, you’re good to go! You can also optionally run `Get-ADUser` or maybe [`Get-ADComputer`](https://adamtheautomator.com/get-adcomputer/) to then ensure the object does show up. ```powershell Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*DEL:*"' –IncludeDeletedObjects Get-ADUser -Identity 'TestUser5' ``` ![Verifying that the TestUser5 has been restored.](https://adamtheautomator.com/wp-content/uploads/2020/10/Untitled-2020-10-10T140155.752.png) Verifying that the TestUser5 has been restored. ## Emptying the Active Directory Recycle Bin If you’d like to remove all of the recycled AD objects, you can do so with PowerShell. Find all of the deleted objects as done before and pipe them to the `Remove-ADObject` command as shown below. In the example below, the `Confirm` parameter is set to false. Using this parameter will immediately delete each object without any confirmation! ```powershell Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*DEL:*"' -IncludeDeletedObjects | Remove-ADObject -Confirm:$false ``` ## Changing the Tombstone Lifetime By default, the tombstone lifetime of the Active Directory recycle bin is 180 days. But maybe you’d like to change that. Again, using PowerShell, you can make it happen. 1. First, find the existing lifetime to ensure it’s not already set as required using the code snippet below. The value is stored in the _tombstoneLifetime_ AD attribute. ```powershell $ADNamingContext = (Get-ADRootDSE).configurationNamingContext $Params = @{ "Identity" = "CN=Directory Service,CN=Windows NT,CN=Services,$ADNamingContext" "Partition" = $ADNamingContext "Properties" = '*' } Get-ADObject @Params | Select-Object -Property tombstoneLifetime ``` 2\. Next, change the tombstone lifetime to something else. Let’s say you’d like to extend the lifetime to one full year or 365 days. You can do that by using the `Set-ADObject` cmdlet and passing it all of the required parameters below. ```powershell $ADNamingContext = (Get-ADRootDSE).configurationNamingContext $Params = @{ "Identity" = "CN=Directory Service,CN=Windows NT,CN=Services,$ADNamingContext" "Partition" = $ADNamingContext "Replace" = @{tombstoneLifetime='365'} } Set-ADObject @Params ``` This change will take affect immediately, no restart of any services needed. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Factive-directory-recycle-bin%2F&text=Active%20Directory%20Recycle%20Bin%3A%20Enable%2C%20Manage%2C%20and%20Optimize)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Factive-directory-recycle-bin%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Factive-directory-recycle-bin%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-11.webp) ### [How to Troubleshoot Active Directory Replication Errors](/troubleshoot-active-directory-replication-errors/) Troubleshoot Active Directory replication errors by isolating 1311, 1722, 2087, and USN rollback issues with repadmin, dcdiag, DNS, RPC, and KCC checks. ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-7.webp) ### [Migrate Group Policy to Intune Without Breaking Endpoints](/gpo-intune-migration/) Export GPOs as XML, analyze them with Group Policy Analytics, migrate supported settings to Intune Settings Catalog, and resolve hybrid device conflicts. ![](https://adamtheautomator.com/wp-content/uploads/2026/06/ditch-gpos-intune-featured.webp) ### [Ditch the GPOs: Migrate to Microsoft Intune](/ditch-gpos-migrate-microsoft-intune-2/) Use Group Policy Analytics to migrate GPOs to Intune Settings Catalog profiles, handle unsupported Group Policy Preferences, and manage hybrid AD-to-MDM transitions. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)