How to Recover Objects with the Active Directory Recycle Bin

Adam Listek

Adam Listek

Read more posts by this author.

Since Windows Server 2008 R2, Active Directory has had a recycle bin that allows recovering objects after they have been deleted with the Active Directory Recycle Bin. This very useful utility has saved countless system administrators over the years. In this article, we explore exactly how the recycle bin functions, what can be done with the recycle bin, and how to effectively use it.

How Does the Recycle Bin in Active Directory Work?

A few operations occur when the recycle bin is enabled in Active Directory and before the object itself is fully removed. It’s a bit complicated, but the process is as below.

Logically Deleted Objects

The first stage is where an object is still recoverable using the recycle bin and is considered logically deleted.

  1. An object, TestUser, is deleted in Active Directory.
  2. The TestUser object is moved to the container CN=Deleted Objects in the domain.
  3. The attribute isDeleted is set to TRUE on the TestUser object.

The amount of time that a logically deleted object can be recovered is set by the msDS-deletedObjectLifetime attribute. The default value is the same number of days as the Tombstone Lifetime which defaults to 180 days.

Object is Tombstone Recycled

After the logically deleted object exceeds the deleted object lifetime, the object is considered tombstones. At this point, the object is not recoverable, even though the isRecycled attribute does not exactly imply that. This attribute won’t actually exist until the object is truly recycled.

  1. After the msDS-deletedObjectLifetime time has been exceeded, the isRecycled attribute is set to TRUE and the isDeleted attribute remains TRUE.
  2. After the object has existed for the value of the tombstone lifetime, the object is then physically deleted from the database via garbage collection. After the next online defrag, the whitespace will be recovered from the database.

The tombstone lifetime is also a default of 180 days.

Enable the Recycle Bin in Active Directory

First, navigate to the Active Directory Administrative Center. Click on the domain located on the left-hand side and find the Tasks menu on the right-hand side. Click on the Enable Recycle Bin option to enable the recycle bin.

Enabling the Active Directory Recycle Bin.
Enabling the Active Directory Recycle Bin.

You will be prompted with a confirmation to enable the recycle bin. As the prompt states, once the recycle bin is enabled, then it cannot be disabled.

Confirmation prompt for the recycle bin.
Confirmation prompt for the recycle bin.

Depending on how large your domain is, it may take some time to propagate the settings.

Confirmation that the process to enable the recycle bin has begun.
Confirmation that the process to enable the recycle bin has begun.

After a refresh, you should see that the Enable Recycle Bin option is grayed out and is enabled.

Verification that the recycle bin has been enabled.
Verification that the recycle bin has been enabled.

Using PowerShell to Enable the Active Directory Recycle Bin

It’s always useful to know how to do this in the GUI, but it’s even better done via PowerShell for scripted installs. Using the Enable-ADOptionalFeature we can turn on the Recycle Bin Feature using the example shown below.

$Params = @{
  "Identity" = 'Recycle Bin Feature'
  "Scope"    = 'ForestOrConfigurationSet'
  "Target"   = 'ad.lc-test.local'
}

Enable-ADOptionalFeature @Params

Using the Active Directory Recycle Bin using the GUI

You can use the Active Directory Recycle Bin via the GUI and PowerShell. First, navigate to the Deleted Objects section in the Active Directory Administrative Center.

Demonstration of the new Deleted Objects OU.
Demonstration of the new Deleted Objects OU.

Next, locate the object to restore. In this case, we are looking for the TestUser2 object. On the right-hand Tasks menu, there are four options.

  • Restore – Restore the object to its original organizational unit (OU).
  • Restore To… – Instead of restoring the object to the original location, choose a different organizational unit to restore the object to.
  • Locate Parent – This option will take you directly to the organizational unit that the object was contained within.
  • Properties – View very limited properties such as Modified, Created, Object Class, Canonical Name, or Update Sequence Numbers (USN).
Showing that the TestUser2 is in the Deleted Objects OU.
Showing that the TestUser2 is in the Deleted Objects OU.

In this example, we will restore the object to its original organizational unit located in Users by clicking on the Restore button and as you can see the object is now back under the Users OU.

Demonstrating that TestUser2 has been restored.
Demonstrating that TestUser2 has been restored.

Restoring an Active Directory Object via PowerShell

As useful as that technique, it’s often even easier and more scriptable using PowerShell to do the same tasks as done under the GUI. First, we need to locate the objects to delete. This can be done using the Get-ADObject command located in the ActiveDirectory module.

Make sure to import the ActiveDirectory module first, like so: Import-Module -Name 'ActiveDirectory'

There are a few ways that the results can be filtered, but crucial to making this work is the IncludeDeletedObjects parameter. Run by itself, with a broad filter like -Filter *, will result in a lot of unnecessary object results. To target only those results that should be in the recycle bin we can filter down the objects like so.

To learn more about filtering AD objects, see this great article.

Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*DEL:*"' –IncludeDeletedObjects
Querying for deleted objects via PowerShell.
Querying for deleted objects via PowerShell.

There is a handy, isDeleted property and the names of objects that have been deleted will contain the DEL: string. Once we have our list, we would like to restore the object. This can be done using the [Restore-ADObject] command.

Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*DEL:*"' –IncludeDeletedObjects | Restore-ADObject
Restoring the AD object from the recycle bin.
Restoring the AD object from the recycle bin.

No information is returned from this command, so we will need to see if the object itself is now restored. First, we will check the recycle bin and verify that the object no longer exists there. Next, we can query the organizational unit that the object was originally in to verify that it now exists there. As you can see, this object is located in the Users OU as it was originally as indicated in the DistinquishedName property.

Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*DEL:*"' –IncludeDeletedObjects

Get-ADUser -Identity 'TestUser5'
Verifying that the TestUser5 has been restored.
Verifying that the TestUser5 has been restored.

Exploring the Restore-ADObject Command

There are a few additional parameters that are not explored in-depth here that might be of use, depending on your use case.

  • Identity – Either the distinguished name, objectGUID, objectSid, or SAMAccountName used to identify the object to restore.
  • NewName – To specify a different name than the original one for the restored object, use the NewName parameter. The value of the msDS-lastKnownRDN attribute is used if this property is not specified.
  • TargetPath – If you want to restore the object to a different organizational unit than the one that the object was originally deleted from, use the TargetPath parameter. Pass in the distinguished name of the OU to restore the object to. If this parameter is not used, the lastKnownParent attribute is used.

Just like the GUI, you are able to restore the object to a different location, but unlike the GUI you are able to specific a different name to restore the object to. This is useful if you have a new object named the same but still need to restore the original object.

Emptying the Active Directory Recycle Bin

Using the GUI, there is no way to fully empty the recycle bin. If you want to remove all objects from within the recycle bin, simply use the same Get-ADObject call as we previously had and pipe the output to the Remove-ADObject command.

Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*DEL:*"' -IncludeDeletedObjects | Remove-ADObject -Confirm:$false

Confirm is set to false in this example, which will immediately delete each object. If you want to confirm a deletion for each individual object, remove the confirm parameter.

Changing the Tombstone Lifetime

Since the amount of time that an object is available in the recycle bin is tied to the Tombstone Lifetime, it is prudent to first understand the existing value. Using the code below we can retrieve the existing tomestoneLifetime value.

$ADNamingContext = (Get-ADRootDSE).configurationNamingContext

$Params = @{
  "Identity"   = "CN=Directory Service,CN=Windows NT,CN=Services,$ADNamingContext"
  "Partition"  = $ADNamingContext
  "Properties" = '*'
}

Get-ADObject @Params | Select-Object -Property tombstoneLifetime

Next, we want to configure the value to be 365 to retain the objects for longer than the default 180 days. This is easy to do by setting the tombstoneLifetime value to the value that you want.

$ADNamingContext = (Get-ADRootDSE).configurationNamingContext

$Params = @{
  "Identity"  = "CN=Directory Service,CN=Windows NT,CN=Services,$ADNamingContext"
  "Partition" = $ADNamingContext
  "Replace"   = @{tombstoneLifetime='365'}
}

Set-ADObject @Params

This change will take affect immediately, no restart of any services needed.

Conclusion

With PowerShell scripting, as in any scripting language, with great power comes the ability to easily delete many objects at once. Using the Active Directory Recycle Bin gives a peace of mind to those working with AD. Thankfully, it is very easy to configure and use and subsequently restore objects.

The Active Directory recycle bin is not necessarily a replacement for a full featured backup program that can take snapshots of Active Directory or fully lifecycle manage an object. The peace of mind that the recycle bin can bring without an additional solution, is well worth the minimal additional space that this feature will add to the database. Start using the Active Directory recycle bin today!

Subscribe to Adam the Automator

Get the latest posts delivered right to your inbox

Looks like you're offline!