If an object in your Active Directory (AD) environment has been deleted and you need to recover it, Microsoft provides a few different ways to do that. This guide will explain the steps needed to restore deleted AD objects with all their attributes intact.
In AD, you can use the following tools to restore deleted objects:
For any of the above methods to work, the native AD Recycle Bin must be enabled. If Recycle Bin is not enabled, most object attributes will be removed when the objects are deleted. The objects can still be restored, but the missing attributes will have to be manually added back.
On the other hand, if the Recycle Bin is enabled, the objects and all their attributes are preserved for the tombstone lifetime period, which can be set by changing the msDS-deletedObjectLifetime attribute.
Before you enable the AD recycle bin, ensure that the domain and forest functional levels are at least at Windows Server 2008 R2.
Note: Once the AD Recycle Bin has been enabled, it cannot be disabled.
To enable the AD Recycle Bin, execute the following command in PowerShell:
Enable-ADOptionalFeature –Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=www,DC=zylker,DC=com’ –Scope ForestOrConfigurationSet –Target ‘www.zylker.com’
If you use Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012, you can use the Active Directory Administrative Center to enable the Recycle Bin.
To restore a deleted object, open PowerShell and type in the following command:
Restore-ADObject -Identity $dn
Here, $dn is the distinguished name of the object to be restored. To find the distinguished name of the object, use the following script in PowerShell:
(Get-ADObject -SearchBase (get-addomain).deletedobjectscontainer -IncludeDeletedObjects -filter "samaccountname -eq '%OLD_NAME%' ")
To find the distinguished name of the object and to perform the restoration, use the following script in PowerShell:
(Get-ADObject -SearchBase (get-addomain).deletedobjectscontainer -IncludeDeletedObjects -filter "samaccountname -eq '%OLD_NAME%' ") | Restore-ADObject
Here, %OLD_NAME% is the name of the object before being deleted.
Want a way to restore deleted objects in AD without scripts?Try RecoveryManager Plus
Note: When you restore the objects present inside the organizational unit (OU), make sure that the distinguished name you provide contains the name of its parent OU. If the parent OU is not mentioned, the object will be restored to the root domain, and you’ll have to manually move it to the correct OU.
ManageEngine's RecoveryManager Plus enables you to overcome all the shortcomings of the native tools while adding more value with the addition of its other capabilities.
With RecoveryManager Plus, you can restore objects with all their attributes intact, even if the native Recycle Bin is not enabled; this is possible because RecoveryManager Plus comes bundled with its own Recycle Bin feature. All AD objects that have been deleted can be found there, and you can even preview the attributes that will be restored along with the object. You can also use the available filters to limit the search results to required object type (user, OU, group, etc.), or search for the deleted object by name.
RecoveryManager Plus is a better alternative to native tools: no endless PowerShell scripting; no need to sift through countless entries to find the deleted object, like in LDP utility.
Besides restoring deleted objects, RecoveryManager Plus is a multifaceted tool with several capabilities that make it a must-have for sysadmins who want total control over the contents of their AD.
|Features||PowerShell||LDP utility||Active Directory Administrative Center||RecoveryManager Plus|
|Restore live AD objects to any of their past versions|
|Granular GPO restoration|
Learn more about the various features that RecoveryManager Plus has to offer.