Recovering nested OUs in Active Directory 

To restore a deleted object, open PowerShell and type in the following command: 

Here, $dn is the distinguished name of the object to be restored. To find the distinguished name of the object, use the following script in PowerShell:

To find the distinguished name of the object and to perform the restoration, use the following script in PowerShell:

Here, %OLD_NAME% is the name of the object before being deleted. 

Unlike restoring a single object, restoring an OU and its constituent objects is not a single step process.

Considering the scenario mentioned above, when the HR_Department OU is deleted, all the objects that it contains―a total of six objects including the two OUs and the four users―are moved to the Deleted Objects container with their distinguished names mangled. The Deleted Objects container displays all deleted objects in a flat hierarchy as its direct children, and the original hierarchy is lost. If the administrator has to restore the HR_Department OU, they have to somehow identify that OU's original hierarchy. 

To restore the OU HR_department, you'll first need to find the original hierarchy of the OU. 

If you know the original hierarchy of the deleted OU, you can use the Restore-ADObject cmdlet to retrieve the deleted objects one hierarchy level at a time.

If you’re not familiar with the original hierarchy, you must first identify the hierarchy before starting the restoration process.

For example, if you want to find the hierarchy of the user account Emma, the PowerShell cmdlet must be constructed so that the lastKnownParent attribute of Emma is returned.

In the output this cmdlet returns, the value of lastKnownParent for Emma is HR_Department. You can also notice that the distinguished name of the HR_Department OU is mangled, which indicates that the HR_Department OU object itself was deleted. 

Here's an example of a mangled distinguished name:
OU=HR_Department\0ADEL:d662511-4bde-b24e-f665bfa96e7b,CN=Deleted Objects,DC=validate4,DC=com
You then have to search for all objects in the Deleted Objects container whose lastKnownParent value is HR_Department.

In the output that this cmdlet returns, you can notice that Managers is an OU. You now have to search for all the deleted objects that were contained in the Managers OU. The objects in the Managers OU will contain a lastKnownParent attribute equal to Managers.

In the output that this cmdlet displays, You will see just the user account Harry and no other objects within the OU. You now have the list of all objects that were deleted and can start with the restoration. Since the HR_Department OU is the object at the top of the hierarchy, it must be restored first. Because all previous investigation steps were performed using the lastKnownParent attribute—which points to the direct parent of the object and does not indicate whether the next parent object is also deleted—administrators can verify that the value of lastKnownParent for HR_Department is indeed a live OU by running the following command:

This concludes the investigation, and you’re now ready to restore the HR_Department OU to its original hierarchy and state.

To restore the HR_Department OU using PowerShell, perform the following operations in the domain controller.

• Click Start, and then click Administrative Tools. Right-click the Active Directory Module for Windows PowerShell, and then click Run as administrator.
• Restore the HR_Department OU (the highest level of hierarchy of the objects to be restored) by running the following command:

Get-ADObject -ldapFilter:"(msDS-LastKnownRDN=HR_Department)" –IncludeDeletedObjects | Restore-ADObject


• Restore the user accounts Jack, Vincent, and Emma and the Admins OU (the direct children of the HR_Department OU whose distinguished name was restored to OU=HR_Department,DC=validate4, DC=com in the previous step) by running the following command:

Get-ADObject -SearchBase "CN=Deleted Objects,DC= validate4,DC=com" -Filter {lastKnownParent -eq 'OU=HR_Department,DC= validate4,DC=com'} -IncludeDeletedObjects | Restore-ADObject


• Restore the user account Harry (the direct child of the Admins OU whose distinguished name was restored to OU=Admins,OU=HR_Department,DC=validate4,DC=com in the previous step) by running the following command:

Get-ADObject -SearchBase "CN=Deleted Objects,DC=validate4,DC=com" -Filter {lastKnownParent -eq 'OU=Admins,OU=HR_Department,DC=validate4,DC=com'} -IncludeDeletedObjects | Restore-ADObject

• 1. Open Command Prompt and type ldp.exe and press the Enter key to start the ldp.exe utility.
• 2. Open the Connect dialog box by navigating to Connection > Connect. 
• 3. Enter the domain name, and default port number as 389.
• 4. Click OK.
• 5. Navigate to Connect > Bind or click Ctrl + B to open the Bind dialog box.
• 6. Select Bind as currently logged on user and click OK.
• 7. Navigate to Options > Controls or press the Ctrl + L shortcut.
• 8. Navigate to Load Predefine > Return Deleted objects and click OK.
• 9. Navigate to View > Tree. Provide the distinguished name of the deleted objects container in the space provided. In this case, CN=Deleted Objects,DC=Terminator,DC=domain,dc=com
• 10. Click OK to view deleted objects.
• 11. Expand the container in the left-pane.
• 12. Identify the parent OU, in this case, the HR_Department, and locate it in the left-pane.
• 13. Right-click the OU and click Modify.
• 14. In the dialog box that appears, type IsDeleted in the Edit Entry Attribute field.
• 15. Select Delete option and click Enter.
• 16. Type distinguishedName in the Edit Entry Attribute field and provide the distinguished name of the OU in the Values field.
• 17. Make sure that the Extended checkbox is selected.
• 18. Click Run to restore the OU. 
• 19. Once the parent OU is restored, repeat the steps 12 to 18 to restore all the objects contained in the HR_Department OU.

Note: When you restore the objects present inside the OU, make sure that the distinguished name you provide contains the name of its parent OU. For example, if you’re restoring the user Emma Roberts, the DN should be CN=Emma Roberts,CN=HR,DC=Terminator,DC=com. If the parent OU is not mentioned, the user object will be restored to the root domain and you’ll have to manually move it to the HR OU.

To restore the deleted OUs using the Administrative Center, 

• Open Active Directory Administrative Center from the Start menu.
• In the left-pane, click the domain name and select the Deleted Objects container under it. 
• For the scenario mentioned above, select the parent OU, HR_Department, and click the Restore button in the right-pane.
• Select the OU Managers and click the Restore button in the right-pane.
• Select all the users who were deleted and click the Restore button in the right-pane.

The restoration has to be performed hierarchically and each user object will be restored to the OU in which it was present before deletion. All attributes along with their group membership information will be restored. 

We can see from the above examples that while PowerShell, LDP utility, and Active Directory Administrative Center can be used to restore deleted OUs, the process of restoring them is not always straightforward. 

All three native tools have a couple of common shortcomings

1. Lack of hierarchical restoration.

2. Native AD Recycle Bin has to be enabled and a setting a large value for Tombstone Lifetime attribute can increase the size of Directory Information Tree (DIT).

Additionally, recovering nested OUs using PowerShell and LDP utility involves a lot of steps which increases the complexity if the number of objects contained in the OU is large.

RecoveryManager Plus allows you to overcome all the shortcomings of the native tools while adding more value in terms of its other capabilities. 

Considering the same use case as the one above, the following section will explain how RecoveryManager Plus can be used to restore all the deleted objects. 

Unlike the native tools that require you to restore objects from the highest level of hierarchy, RecoveryManager Plus allows you to restore any object irrespective of its original hierarchy. When an object and its parent container are deleted, restoring the deleted object automatically restores the parent container too, eliminating the need to restore containers individually. 

RecoveryManager Plus allows you to restore objects with all their attributes intact even if the native Recycle Bin is not enabled. This is possible because RecoveryManager Plus comes bundled with its own Recycle Bin feature. All AD objects that have been deleted can be found here and you can even preview the attributes that will be restored along with the object., You can also use the available filters to limit the search results to required object type (user, OU, group, etc) or search for the deleted object by name. 

When the entire HR_Department OU is deleted, you can find the deleted OU and all its constituent objects in RecoveryManager Plus's Recycle Bin.

If the administrator knows the original hierarchy of the deleted OU, the admin can select just the parent container and recycle it, which will automatically restore all the constituent objects of the OU. 

Other key features of RecoveryManager Plus 

Besides restoring deleted objects, RecoveryManager Plus is a multifaceted tool with several capabilities that make it a must-have for administrators who want total control over the contents of their AD. 

Learn more about the various features that RecoveryManager Plus has to offer.