Restore Active Directory Deleted Objects Using Recycle Bin

Prerequisites for Restoring Deleted AD Objects

Before restoring deleted objects in Active Directory, verify the following requirements:

• Active Directory Recycle Bin: To restore deleted objects using Active Directory Administrative Center (ADAC) or PowerShell, Recycle Bin must have been enabled before the objects were deleted. Enabling it afterward does not make previously deleted objects recoverable through Recycle Bin.
• Forest Functional Level: Active Directory Recycle Bin requires a forest functional level of Windows Server 2008 R2 or later.
• Deleted Object Lifetime: The object must still be within its deleted-object lifetime and must not have entered the recycled state. Recycled objects cannot be restored using Recycle Bin.
• Administrative Permissions: Use an account with sufficient permissions to restore the deleted object. Domain Admins or appropriately delegated administrators can perform restoration.
• Required Tools: Use Active Directory Administrative Center (ADAC) for graphical restoration or the Active Directory PowerShell module for command-line restoration.

Note: If Active Directory Recycle Bin was not enabled before deletion, recovery may still be possible through tombstone reanimation or a suitable Active Directory backup, although the original attributes and group memberships may not be fully recovered.

How to Restore Deleted Active Directory Objects Using ADAC

Active Directory Administrative Center (ADAC) provides a graphical interface for restoring deleted Active Directory objects, including users, groups, and organizational units (OUs), provided Active Directory Recycle Bin was enabled before deletion and the objects are still within their deleted-object lifetime.

Follow these steps to restore a deleted object:

1. Open Active Directory Administrative Center: Press Windows + R, type dsac.exe, and press Enter.
2. Open the Deleted Objects container: In the navigation pane, select your domain and open the Deleted Objects container.
3. Locate the deleted object: Find and select the user, group, or organizational unit you want to restore.
4. Restore the object: Right-click the deleted object and select Restore to return it to its original location. Alternatively, select Restore To to restore it to a different container.
5. Verify restoration: Navigate to the target organizational unit in ADAC or Active Directory Users and Computers (ADUC) and confirm that the restored object is present.

Note: If the object’s original parent container has been deleted, restore the parent first or use Restore To to select an existing destination. Restoration may also fail if another object already uses the same distinguished name.

How to Restore Deleted Active Directory Objects Using PowerShell

PowerShell allows administrators to find and restore deleted Active Directory objects using the Get-ADObject and Restore-ADObject cmdlets. This method requires Active Directory Recycle Bin to have been enabled before deletion and the object to remain within its deleted-object lifetime.

Follow these steps to restore a deleted user account named testuser3.

1. Open PowerShell and Import the Active Directory Module

   Open Windows PowerShell with an account that has the required Active Directory permissions and run:

   Import-Module ActiveDirectory

2. Find the Deleted Active Directory Object

   Run the following command to locate the deleted user account:

   Get-ADObject -Filter 'msDS-LastKnownRDN -eq "testuser3" -and isDeleted -eq $true -and isRecycled -ne $true' -IncludeDeletedObjects -Properties lastKnownParent,msDS-LastKnownRDN,isRecycled

   The command displays the deleted object, including its ObjectGUID and DistinguishedName. Confirm that the returned object is the intended user before proceeding.

3. Restore the Deleted Object

   Copy the ObjectGUID from Step 2 and execute:

   Restore-ADObject -Identity "64f1e4dc-7722-4839-9fec-90347ad708cb"

   Replace the example GUID with the actual GUID of the deleted object.

4. Verify the Restored Object

   Run the following command:

   Get-ADUser -Identity "testuser3"

   Confirm that the user account exists and appears in the expected organizational unit (OU).

Note: If the original parent container no longer exists, restore the parent container first or use the -TargetPath parameter with Restore-ADObject to specify an existing destination.

How to Restore Deleted Active Directory Objects Using LDP.exe

LDP.exe is an LDAP administration utility that can be used to reanimate deleted Active Directory objects when Active Directory Recycle Bin was not enabled before deletion. Unlike Recycle Bin restoration, tombstone reanimation provides limited recovery because many original object attributes and group memberships are removed during deletion.

Follow these steps to restore a deleted object using LDP.exe:

1. Open LDP.exe: Press Windows + R, type ldp.exe, and press Enter.
2. Connect to a domain controller: From the Connection menu, select Connect. Enter the domain controller’s hostname, specify port 389 for LDAP, and click OK.
3. Authenticate: From the Connection menu, select Bind. Select Bind as currently logged on user if your account has sufficient permissions, then click OK.
4. Enable deleted-object visibility: Select Options > Controls. From the Load Predefined dropdown, choose Return Deleted Objects, select Server as the control type, and click OK.
5. Open the Deleted Objects container: Select View > Tree and enter the distinguished name of the Deleted Objects container. For example:

   CN=Deleted Objects,DC=domain,DC=com

   Replace DC=domain,DC=com with your actual domain distinguished name.

6. Locate the deleted object: Expand the Deleted Objects container and find the object you want to restore. Review its attributes, including lastKnownParent, to identify its previous location.
7. Open the Modify dialog: Right-click the deleted object and select Modify.
8. Remove the isDeleted attribute: In Edit Entry Attribute, enter isDeleted. Leave the Values field blank, select Delete, and click Enter. Do not click Run yet.
9. Specify the restoration location: In Edit Entry Attribute, enter distinguishedName. In Values, enter the full distinguished name of the restored object. For example:

   CN=testuser3,OU=Users,DC=domain,DC=com

   Select Replace and click Enter to add the operation.

10. Restore the object: Select the Synchronous and Extended checkboxes, then click Run to execute both modifications in a single LDAP operation.
11. Verify restoration: Open Active Directory Users and Computers (ADUC) and confirm that the object appears in the specified organizational unit. For restored user accounts, reset the password, review the account status, and restore any missing attributes or group memberships as required.

Important: Tombstone reanimation does not restore all original object attributes or group memberships. It is available only while the tombstone remains recoverable. For complete restoration, a suitable Active Directory backup may be required.

How to Check and Change Deleted Object and Tombstone Lifetimes

Active Directory uses two attributes to determine how long deleted objects are retained:

• tombstoneLifetime: Controls how long tombstoned objects are retained when Active Directory Recycle Bin is disabled. When Recycle Bin is enabled, it determines how long recycled objects are retained before becoming eligible for permanent removal.
• msDS-DeletedObjectLifetime: Determines how long deleted objects remain restorable when Active Directory Recycle Bin is enabled. If this attribute is not configured, the deleted-object lifetime defaults to the effective tombstone lifetime.

The tombstone lifetime is typically 180 days in forests created with Windows Server 2003 SP1 or later. Older forests may have a 60-day default. Administrators should verify their forest’s actual configuration rather than assume a particular value.

Steps to Check and Change the Lifetime Settings

1. Press Windows + R, type adsiedit.msc, and press Enter to open ADSI Edit.
2. Right-click ADSI Edit and select Connect to. Under Select a well known Naming Context, choose Configuration, then click OK.
3. Navigate to:

   CN=Configuration,DC=domain,DC=com > CN=Services > CN=Windows NT > CN=Directory Service

   Replace DC=domain,DC=com with the distinguished name of your forest root domain.

4. Right-click CN=Directory Service and select Properties.
5. Locate the following attributes:
   • tombstoneLifetime — Specifies the configured tombstone lifetime in days.
   • msDS-DeletedObjectLifetime — Specifies the configured deleted-object lifetime in days.

   If either attribute is not set, Active Directory uses its applicable default. An unset tombstoneLifetime has an effective value of 60 days; an unset msDS-DeletedObjectLifetime inherits the effective tombstone lifetime.

6. To change a lifetime, select the relevant attribute, click Edit, enter the required number of days, and confirm the change.
7. Click OK to save the changes.

Important: Changing these values affects object retention across the forest. Reducing the tombstone lifetime can increase the risk of lingering objects if domain controllers have replication problems or remain offline for extended periods. Review your replication health, backup strategy, and recovery requirements before changing either setting. Increasing retention does not recover objects that have already been permanently removed.

Limitations of Native Active Directory Object Recovery

Although Active Directory provides several native methods for restoring deleted objects, these methods have limitations:

• Recovery Period Restrictions: Active Directory Recycle Bin can restore only objects deleted after it was enabled and still within their deleted-object lifetime. Once an object enters the recycled state or is permanently deleted, recovery through Recycle Bin is no longer possible.
• Incomplete Recovery Without Recycle Bin: Tombstone reanimation can recover certain deleted objects, but many original attributes and group memberships are not preserved and may need to be recreated manually.
• Limited Attribute-Level Recovery: Active Directory Recycle Bin restores deleted objects but does not provide a dedicated mechanism for rolling back individual attribute changes made to existing objects.
• Complex Recovery Procedures: PowerShell and LDP.exe require technical knowledge, particularly when identifying deleted objects, handling missing parent containers, or performing tombstone reanimation.
• Limited Centralized Recovery Reporting: Native restoration tools do not provide a single consolidated interface for tracking restoration operations and reviewing recovery history across all recovery methods.

When native recovery is insufficient, administrators may need a suitable Active Directory backup or a dedicated recovery solution.

How Lepide Helps Restore Deleted Active Directory Objects

Lepide Data Security Platform helps administrators restore deleted Active Directory objects and roll back unwanted changes using the Lepide Object Restore Wizard. It captures backup snapshots of Active Directory and Group Policy Objects, either manually or at scheduled intervals, allowing administrators to recover objects from previously captured states.

With Lepide, administrators can:

• Restore Deleted AD Objects: Recover deleted Active Directory objects, including those in the tombstone state, using the Lepide Object Restore Wizard.
• Recover Objects Beyond Recycle Bin Recovery: Restore objects that are no longer recoverable through native Active Directory Recycle Bin, provided a suitable backup snapshot was captured before deletion.
• Compare Active Directory States: Compare the current Active Directory state with a selected snapshot to identify created, modified, deleted, and renamed objects.
• Roll Back Unwanted Changes: Use Active Directory audit reports to identify supported changes and select Restore Change to reverse them.
• Restore Group Policy Objects: Compare Group Policy Objects with previously captured snapshots and restore unwanted changes.
• Generate Snapshot-Based Reports: Generate reports showing historical Active Directory and Group Policy object states, including supported attributes, permissions, and configuration details.

The Lepide Object Restore Wizard allows administrators to select a backup snapshot, review detected changes, and choose the objects or changes they want to restore.

To learn more about these capabilities, schedule a demo of Lepide Data Security Platform Object Restore.

Frequently Asked Questions