In Windows Server 2008 R2 there is a new feature called Active Directory Recycle Bin. This feature makes it possible to restore deleted objects in Active Directory without restore from backup.
Opposite to restoring tomb stoned objects, all object parameters are remained (group membership, sn, dn, and so on).
Active Directory Recycle Bin are disabled by default, even in new Windows Server 2008 R2 domains. As a prerequisite, the forest mode must be set to Windows Server 2008 R2.
When all domain controllers are running Windows Server 2008 R2, this can be accomplished by using the Active Directory module in PowerShell:
Set-ADForestMode –Identity domain.local -ForestMode Windows2008R2Forest
You may also use ldp.exe or the GUI tool “Active Directory Domains and Trusts”.
You can use the Get-ADOptionalFeature to check if the Recycle Bin Feature are enabled.
Before enabling the feature:
After enabling the feature:
When the prerequisites are met, the Active Directory Recycle Bin-feature can be enabled.
Either using the Active Directory module in PowerShell:
Or by using ldp.exe.
When the feature are enabled it`s a good idea to perform some testing. By default all deleted objects are placed in the Deleted Objects container.
In my test I first created a user named “Test User”, and then deleted the user object:
This will retrieve all deleted user objects:
This will restore all deleted user objects:
This will restore a specific user object:
For those of you that are more comfortable using a GUI rather than the PowerShell command-line, a GUI tool for using this new feature are already available. Check out Kirk Munro`s PowerGUI PowerPack for Active Directory Recycle Bin.
This blogpost are based on the official Microsoft documentation on Technet, provided in the Active Directory Recycle Bin Step-by-Step Guide.