Recycling Active Directory Trash with the AD Recycle Bin

Hopefully some of you have been playing with Server 2008 R2 while it has been in Beta.  One of the features I'm looking forward to most is the AD Recycle Bin.  Yes you heard me correct.  We now have an easy method for restoring accidentallydeleted objects.  

In the past our only recovery method out of the box was to perform an authoritative restore of an object. That method had several issues that always rubbed me the wrong way.  First you had to be in Directory Services Restore Mode (DRSM).  And ever since Server 2003 we could use tombstone reanimation but that removed most of the non-link-valued attributes.  This lead to additional work after the restore. The default tombstone lifetime was 180 days with Server 2003 and 2008.

You are probably already familiar with tombstones and the garbage collection process.  If not read Gil's excellent article on that here http://technet.microsoft.com/en-us/magazine/cc137800.aspx.  With Server 2008 R2 you will need to now become aware of Deleted Object and Recycled Object.  The first thing to realize here is that the AD Recycle Bin is not enabled by default with Server 2008 R2.  The following steps/requirements must first be met:

Step 1 - Raise the Forest Functional Level to Server 2008 R2
Step 2 - Enable AD Recycle Bin (my example uses PowerShell&get use to it now)
Step 3 - Enable-ADOptionalFeature -Identity "CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration, DC=AdminPrep,DC=com" -Scope Forest -Target "AdminPrep.com"
Note - Just make sure to replace AdminPrep with your domain

Now when an object is deleted it is not marked for tombstone it is marked as deleted.  It places the object in the Deleted Objects container which is hidden but can be located here - CN=Deleted Objects.  When you want to restore an object there are two methods that I'm aware of, one using PowerShell and the other using LDP.

Using LDP:
Step 1 - Using elevated credentials, open LDP by typing ldp.exe from the Run Dialog box
Step 2 - Click Connections and select Connect and then go back and select Bind
Step 3 - Navigate to the CN=Deleted Objects
Step 4 - Find the object you wish to restore and right-click it and select Modify
In the Modify dialog box:
Step 5 - In Edit Entry Attribute, type isDeleted
Step 6 - Leave the Values box empty
Step 7 - Under Operation, click Delete, and then click Enter
Step 8 - In Edit Entry Attribute, type distinguishedName
Step 9 - In Values, type the original distinguished name (also known as DN) of this Active Directory object
Step 10 - Under Operation, click Replace
Step 11 - Make sure that the Extended check box is selected, click Enter, and then click Run

To restore an object using PowerShell you must use the Get-ADObject and Restore-ADObject cmdlets.  Using PowerShell:
Open the Active Directory PowerShell command Prompt and use the following syntax:
step 1 Get-ADObject-Filter {String} -IncludeDeletedObjects | Restore-ADObject
Here is an example of restoring a deleted user account named Brian:
step 1 Get-ADObject -Filter {displayName -eq "Brian"} -IncludeDeletedObjects | Restore-ADObject

When restoring multiple items that may be linked (OU or Group that contains Users) you will want to start at the highest level.

An object can only be restored using those methods if it is still within the Deleted Object Lifetime.  The attribute is msDS-deletedObjectLifetime and if you look it up it will have a null value which the default time is 180 days.