Recovering nested OUs in Active Directory 

OUs in Active Directory (AD) helps administrators to categorize users depending on the different departments in your organization. When an OU is deleted, the OU, along with all objects contained in it has to be restored. Vital information such as GPOs that are applied to the OUs and any security groups to which the members of the OU were previously a part of must also be restored. 

This article will elaborate on the different ways in which you can restore deleted nested OUs. 

What happens when an OU is deleted?


Active Directory provides a Recycle Bin feature which is disabled by default and has to be enabled manually. If Recycle Bin is enabled in your environment, it provides you additional leeway in restoring OUs with all the necessary information. 

If Recycle Bin is not enabled, the deleted OU is moved to the Deleted Objects container and stripped of most of its attributes. The OU stays in this tombstoned state for 60-180 days depending on the version of your Windows Server and your configuration settings. However, the OU can still be restored using native tools like PowerShell or LDP utility but its missing attributes will have to be manually added back.

When Recycle Bin is enabled, the OU is still moved to the Deleted Objects container but all its attributes are preserved for a duration as specified by your msDS-deletedObjectLifetime attribute. In this stage, the OU can be restored with all its attributes intact.

When the msDS-deletedObjectLifetime period expires, the object is moved to a Recycled Object state where almost all of its attributes are removed. The objects stays in this state as specified by your tombstoneLifetime attribute. Once the tombstoneLifetime period expires, the object is removed from the database by the garbage-collection process and cannot be restored. 

To preserve all attributes of deleted objects, enabling AD Recycle Bin is a must. 

How to enable AD Recycle Bin?


Before you enable AD Recycle Bin, ensure that the domain and forest functional levels are at least Windows Server 2008 R2.

Note: Once AD Recycle Bin has been enabled, it cannot be disabled. 

To enable AD Recycle Bin, execute the following command in PowerShell.

Enable-ADOptionalFeature –Identity 'CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=www,DC=zylker'DC=com' –Scope ForestOrConfigurationSet –Target ''

If you use Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012, you can use the Active Directory Administrative Center to enable the Recycle Bin.

  • In the management console, navigate to Tools > Active Directory Administrative Center.
  • From the left-pane, select the Domain for which you wish to enable Recycle Bin.
  • In the Tasks in the right-hand side of the screen, select Enable Recycle Bin.
  • A dialog box appears with a message that explains how this action is irreversible. Click OK. 
  • Enabling Recycle Bin involves changes made to configuration partition. Wait for AD replication to complete.
  • This process may take a while if your organization has a large AD infrastructure.

What tools can the AD administrators use?


As an administrator, these are the native tools that can be used to restore OUs with all attributes intact, provided AD Recycle Bin has been enabled. 

  • PowerShell
  • LDP utility
  • Administrative Center

Consider the following scenario: An administrator of accidentally deletes a nested organizational unit (OU) called HR_Department, which contains user accounts of employees in the HR department. The deletion of the OU results in deletion of a nested OU called Managers, which contains user accounts of the managers who work in the HR department. Jack, Vincent, and Emma are user accounts in the HR_Department OU. Harry is a user account in the Managers OU. The following illustration shows the hierarchy of the HR_Department OU.

The article will explain how these objects can be restored using the native AD tools.

Note: When restoring objects using native tools, it's critical to begin restoring objects from the highest level of the hierarchy because deleted objects can only be restored to a live parent.

Evaluate RecoveryManager Plus to try out features like backing up and recovering AD objects. Support is included in your trial if you need any assistance. Download your fully functional 30-day free trial today.

A single pane of glass for Active Directory, Azure Active Directory,
Microsoft 365, Google Workspace, and Exchange Backup.