If you accidentally Deleted an Active Directory user, you can easily restore it. The fact is that when you delete any object from Active Directory, it is not deleted immediately. First, the value of the isDeleted = true attribute is set for the object, then it is moved to the special container—Deleted Objects.

Objects in the Deleted Objects container do not appear in the ADUC console and are not available for most service tools. Deleted objects are permanently deleted from AD after 180 days (determined by the value of the tombstoneLifetime attribute—TSL) by the AD garbage collection automatic process.

In this article, we will take a look at several scenarios for restoring a deleted user object in Active Directory. Let’s run the Active Directory Users & Computers snap-in and delete the user Jon Brion.

To find the removed user account properties, you can use the following PowerShell command:

Get-ADObject -Filter 'SAMAccountName -eq "jbrion"' –IncludeDeletedObjects

Deleted : True

DistinguishedName : CN=Jon Brion.\0ADEL:3c206e08-a114-429b-b122-cad9d10b37e7,CN=Deleted Objects,DC=theitbros,DC=com

Name : Jon Brion.

DEL:3c206e08-a114-429b-b122-cad9d10b37e7

ObjectClass : user

ObjectGUID : 3c206e08-a114-429b-b122-cad9d10b37e7

As you can see from the DistinguishedName, this user account is placed to the Deleted Objects container.

If you don’t know the exactly username for restore, you can list all deleted user accounts in the domain with the command:

Get-ADObject –filter {Deleted -eq $true -and ObjectClass -eq "user"} –includeDeletedObjects|format-table

Using the parameters returned by the previous command, you can restore the user object. We prefer to use ObjectGUID. To restore an object, use the command:

Restore-ADObject -Identity '3c206e08-a114-429b-b122-cad9d10b37e7'

or you can restore the user object with a PowerShell one-liner:

Get-ADObject -Filter 'SAMAccountName -eq "jbrion"' –IncludeDeletedObjects | Restore-ADObject -identity

In this case, the user account is restored to the same AD organizational unit.

If you feel uncomfortable in the PowerShell CLI, you can restore the user from the Active Directory Administrative Center graphical snap-in (dsac.exe). Choose your domain > Deleted Objects container. This container contains all of the deleted AD objects.

In order to restore user in Active Directory, click on the account and select the Restore menu item.

Previous ways should successfully restore the deleted user if the AD recycle bin feature is enabled in your Active Directory forest. To check if the feature is enabled, run the following command:

Get-ADOptionalFeature “Recycle Bin Feature” | select-object name, EnabledScopes

If the EnabledScopes value is empty, then the AD Recycle Bin is disabled in your forest. When the AD Recycle Bin is disabled, the Restore-ADObject cmdlet returns an error:

Restore-ADObject : Illegal modify operation. Some aspect of the modification is not permitted

To enable the AD Recycle Bin feature (requires the AD forest functional level Windows2008R2Forest or higher), run the following command with the Enterprise administrator permissions:

Enable-ADOptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target theitbros.com

Hint. When you enable the AD Recycle Bin, the Deleted Objects container is being cleared. You cannot use the Restore-ADObject to restore objects that were deleted before the AD Recycle Bin was enabled.

If the AD Recycle Bin is disabled, you can use the free AdRestore tool from Sysinternals to restore objects in Active Directory. Download the AdRestore archive and extract it to your local drive.

To restore a deleted user account, simply specify its GUID as an argument:

adrestore -r 45ac5afa-ddb5-4382-85d4-5c1ce6716f11

Confirm restoration of the object. A “Restore succeeded” message should appear.

The post How to Restore Deleted Active Directory User? appeared first on TheITBros.