How to use the new Active Directory Recycle Bin feature

 

In Windows Server 2008 R2 there is a new feature called Active Directory Recycle Bin. This feature makes it possible to restore deleted objects in Active Directory without restore from backup.
Opposite to restoring tomb stoned objects, all object parameters are remained (group membership, sn, dn, and so on).

Active Directory Recycle Bin are disabled by default, even in new Windows Server 2008 R2 domains. As a prerequisite, the forest mode must be set to Windows Server 2008 R2.
When all domain controllers are running Windows Server 2008 R2, this can be accomplished by using the Active Directory module in PowerShell:
Set-ADForestMode –Identity domain.local -ForestMode Windows2008R2Forest

You may also use ldp.exe or the GUI tool “Active Directory Domains and Trusts”.

You can use the Get-ADOptionalFeature to check if the Recycle Bin Feature are enabled.

Before enabling the feature:

image

After enabling the feature:

image

 

When the prerequisites are met, the Active Directory Recycle Bin-feature can be enabled.
Either using the Active Directory module in PowerShell:

image

Or by using ldp.exe.

When the feature are enabled its a good idea to perform some testing. By default all deleted objects are placed in the Deleted Objects container.

In my test I first created a user named “Test User”, and then deleted the user object:

image

This will retrieve all deleted user objects:

image

This will restore all deleted user objects:

image

This will restore a specific user object:

image

For those of you that are more comfortable using a GUI rather than the PowerShell command-line, a GUI tool for using this new feature are already available. Check out Kirk Munros PowerGUI PowerPack for Active Directory Recycle Bin.

This blogpost are based on the official Microsoft documentation on Technet, provided in the Active Directory Recycle Bin Step-by-Step Guide.