Someone deletes a user account by mistake. You bring it back, but the person still cannot open shared folders or get mail from their groups. The account exists again, yet it is nearly empty.
This happens when the Active Directory Recycle Bin is not enabled. AD does not erase a deleted object immediately. It keeps a tombstone, but it removes most of the attributes first, and group membership is among them. With the Recycle Bin on, a deleted object keeps every attribute until its lifetime runs out. The feature is off in a new forest. You enable it once for the whole forest, and you cannot disable it later.
When the feature is on, recovery has two steps. First, look at the deleted object and the OU it came from. Then pass it to Restore-ADObject:
Get-ADObject -Filter 'samAccountName -eq "jsmith"' -IncludeDeletedObjects -Properties LastKnownParent |
Format-List Name, LastKnownParent, Deleted
Get-ADObject -Filter 'samAccountName -eq "jsmith"' -IncludeDeletedObjects | Restore-ADObject
LastKnownParent shows the old OU. If that OU was deleted too, the restore fails, because the user has no parent to return to. Restore the OU first, or choose an existing OU with -TargetPath.
The full guide shows how to check the feature and enable it, and which rights and forest level you need. It restores a whole OU and its contents in the correct order. It explains what you can still do when the Recycle Bin was off. It also gives one command that protects every OU from accidental deletion.
Read the full guide: https://learnitlessons.com/articles/ad-recycle-bin-restore-deleted-objects/
Written with AI assistance and checked by the author.
Top comments (0)