How to Restore Deleted Active Directory User?

9.4K

If you delete an Active Directory user, it is not immediately removed from the AD catalog and can be restored. This guide explains how to restore accidentally deleted Active Directory objects.

Restoring Deleted Object in Active Directory

When an AD object is deleted, it is moved to the hidden Deleted Objects container, and its isDeleted attribute is set to True.

Deleted objects are permanently removed from Active Directory after 180 days by default. This retention period is defined by the tombstoneLifetime (TSL) attribute and managed by the AD garbage collection automatic process.

Check the TSL (tombstoneLifetime) value in your domain using the PowerShell command (replace “dc=theitbros,dc=com” with your domain):

Get-ADObject `
 -Identity "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=theitbros,DC=com" `
 -Properties tombstoneLifetime |
 Select-Object tombstoneLifetime

Note that in environments with AD Recycle Bin enabled, object retention may also depend on the deleted object lifetime and recycled object lifetime settings.

Active Directory Recycle Bin

The Active Directory Recycle Bin is an ADDS feature available in Windows Server 2008 R2 and later versions. It makes it much easier to recover deleted objects (such as user accounts, groups, or computer accounts) in an Active Directory environment.

There are two ways to restore deleted objects in Active Directory, depending on whether the Active Directory Recycle Bin is enabled in the domain.

Important things to know about AD Recycle Bin

• Forest functional level Windows Server 2008 R2 or later required
• Once enabled, the AD Recycle Bin cannot be disabled
• If objects were deleted before the Recycle Bin was enabled, they may not become fully recoverable through the Recycle Bin. You need to always check the state of deleted objects before enabling the feature.

Enabling Active Directory Recycle Bin

The AD Recycle Bin is not enabled by default. Therefore, you need to make sure that it is enabled before proceeding to recover a deleted object.

Run the following PowerShell command:

Get-ADOptionalFeature "Recycle Bin Feature" | select-object name, EnabledScopes

If the EnabledScopes property is empty, the Recycle Bin is not enabled, and you cannot use it to restore deleted Active Directory users. In this case, you should proceed with the method of restoring AD object without using AD Recycle Bin.

On the other hand, the below screenshot shows the result if the AD Recycle Bin is enabled.

How to Restore Deleted User without AD Recycle Bin

If the Active Directory Recycle Bin is not enabled in a domain, you can use the LDP.EXE or ADRESTORE.EXE tools to restore deleted objects.

Using LDP.EXE to Restore Deleted Active Directory User

LDP.EXE is a built-in tool available by default on AD domain controllers (can be installed on client computers via RSAT). In this example, the user John Doe was deleted and will be restored using LDP.

1. Run the command with an account that is a member of the Domain Admins or Enterprise Admins group:
   

   ldp.exe

2. Click Connection → Connect and enter the domain controller name.
   

   

3. Click Connection → Bind → Bind as currently logged on user
   

   

4. Verify that authentication was successful.
   

   

5. Click View → Tree

   

6. Select your domain’s base DN from the dropdown list and click OK.

   

7. Navigate to “DC=DOMAIN,DC=TLD” → “CN=Deleted Objects” and double-click the deleted user. You will see the object’s details on the output pane. As you can see, the isDeleted value is TRUE.
   

   

8. To restore the deleted AD user, right-click the object and click Modify.
   

   

9. The next step is to clear the value of the isDeleted attribute. Type isDeleted in the “Edit Entry Attribute” box, select the “Delete” operation and click Enter. The “[Delete]isDeleted:” operation has been added to the list.
   

   

10. The original parent container can usually be obtained from the lastKnownParent attribute of the deleted object. Next, you need to restore the original distinguishedName of the object. The original distinguishedName value should be “CN=USER NAME” + the value of the lastKnownParent attribute.
    

    

    So the restored DN should be:
    

    CN=John Doe,OU=Users,OU=California,OU=USA,DC=theitbros,DC=com

11. Type “distinguishedName” in the “Edit Entry Attribute” box, paste the object’s original distinguishedName to the Values box and click Enter. Lastly, click Run.
    

    

    The output should show no errors if the operation went well.
    

    

12. Open the Active Directory Users and Computers snap-in and verify that the deleted AD user has been restored to the original container.
13. Enable the account and reset the password so that the user can log in.
    

    

Note. Restoring a deleted user account without AD Recycle will not preserve most user settings. Only the original SID and the account name will be preserved. Most user attributes, properties, and group memberships will be lost. The most effective way to restore deleted AD object attributes in this case is by restoring the AD user from a previously created domain controller backup.

Restore Deleted AD Object Using ADRESTORE.EXE

Instead of the complex LDP.exe utility, you can use the lightweight Microsoft ADRESTORE tool to restore deleted objects more easily. ADRESTORE.exe is a command-line tool designed to find and restore “tombstoned” Active Directory objects.

1. Download the ADRESTORE tool and extract it to a local folder. In this example, I extracted the tool to C:\tools\ADRestore.
   

   

2. Open CMD or PowerShell and change the working directory to where you extracted the tool.
   

   

3. Run the adrestore64.exe command to list all the deleted AD objects. The command output includes all deleted AD objects, such as Organizational Units (OUs), users, computers, etc.
4. Or manually search for deleted objects matching the name John Doe: .\adrestore64.exe “John Doe”
5. In this example the command found one matching object.
   

   

6. Copy the object GUID from the previous step and run the below command to restore the deleted Active Directory user: .\adrestore64.exe -r {GUID}

   

7. Check that the user has been restored to the correct AD OU:
   

   Get-ADUser -Identity jdoe 

   

How to Restore Deleted Active Directory User from the Recycle Bin

Restoring a deleted user account is much easier if the Active Directory Recycle Bin is enabled in your domain. You can use the Active Directory Admin Center (GUI) or PowerShell commands.

1. Open the Active Directory Administrative Center using the command: dsac.exe
2. Navigate to Domain → Deleted Objects.
   

   

3. Select the deleted AD object from the list and click Restore. To restore deleted Active Directory users to a different OU, click “Restore To…” instead.
   

   

4. The deleted AD user has been restored to its original OU. You can now reset the password and enable the account.
   

   

Or you can restore deleted Active Directory user by using the Restore-ADObject cmdlet.

You can list all the deleted users in the Active Directory Recycle Bin:

Get-ADObject -ldapFilter:"(msDS-LastKnownRDN=*)" –IncludeDeletedObjects

Or search for the deleted object by its name or samaccountname:

Get-ADObject -Filter 'samaccountname -eq "jdoe"' -IncludeDeletedObjects

Before restoring the object, you need to check if the search result matches the correct deleted user. Run the command:

Get-ADObject -Filter 'samaccountname -eq "jdoe"' -IncludeDeletedObjects -Properties *

You should check attributes such as DistinguishedName, ObjectGUID, LastKnownParent, whenCreated, and ObjectClass before restoring the object.

Copy the DistinguishedName or ObjectGUID value of the object and run the following command to restore the AD object:

Restore-ADObject -Identity {DistinguishedName or ObjectGUID}

Or pipe the result of the Get-ADObject to the Restore-ADObject:

Get-ADObject -Filter 'samaccountname -eq "jdoe"' -IncludeDeletedObjects | Restore-ADObject

The restored AD user is disabled. Enable it and reset the password before it can be used again. Keep in mind that when restored from the AD Recycle Bin, group memberships and most user attributes are preserved.