In a previous entry, guest blogger Sean Kearney shared a new feature in Windows Server 2008 R2 directory services called the Active Directory Recycle Bin.  Sean is back to show us how to recover those deleted objects.

-------------------------

So you’ve done it.  We all have.  Deleted a user, group, OU by accident but thankfully you have 2008 R2 in place and the AD Recycle Bin enabled.  To recover now is a breeze!  Start by launching Powershell V2 on Server 2008 R2 and run the following command

GET-ADOBJECT –filter {name –like “missingitem*”} –includedeletedobjects | RESTORE-ADOBJECT

That’s it.  Nothing harder than that. Was that so hard?  The great thing, is as long as it’s an object in Active Directory, it’s protected by this new feature for 180 days.  Also, this just does restore the object.  It’s restores the object, its security, its trusts!

If you’d like to learn more about the Active Directory Recycle Bin, Check out these great resources on Technet.com

Active Directory Recycle Bin - Instructional Video on Technet Edge

I’ve done it, I know people who have done it, and I bet you have done it before as well.  Right-click an object in Active Directory Users and Computers and instead of clicking the properties link you accidentally hit delete.  Boom, gone and the only way to get it back is via a restore from backup.  Restart the DC, boots into Directory Services Restore Mode (DSRM), restore the system state backup and apply either a authoritative or non-authoritative restore.

Guest author, Sean Kearney, covers this new feature in Windows Server 2008 R2.

-------------------------

One of the fantastic features provided in Server 2008 R2 is the new Recycle Bin for Active Directory.

I recognize that nobody here is going to intentionally mess up their own Active Directory.  But problems can happen.   A Junior technician misheard the phrase “Disable” with “Delete”, a malicious Administrator leaving the company, dumb luck.  Any number of problems can occur and this feature will save the day.

There are a few caveats to using this

• You must have the Domain functional level in Server 2008 R2 mode.
• You must enable the feature by using LDP.EXE or Powershell.
• It is managed and used 100% by Powershell.  There is no GUI version presently.
• Once enabled, you cannot disable it.  This is a one way trip folks
• The enabled Recycle Bin has a 180 day retention policy.

That’s it.  In Server 2008 R2, select the new Active Directory Powershell under Administrative Tools and type in the following command

GET-ADOPTIONALFEATURE –filter {name –like “*”}

You will be presented with a screen showing you

FeatureScope       : {Forest}
Name               : Recycle Bin Feature 
RequiredForestMode : Windows2008R2Forest 
IsDisableable      : False 
ObjectGUID         : 0599c1a6-6f8f-42d4-b9a0-ab2791d4719e 
ObjectClass        : msDS-OptionalFeature 
FeatureGUID        : 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a 
EnabledScopes      : 
RequiredDomainMode : 
DistinguishedName  : CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=energized,DC=energizedtech,DC=com

Looking at the information above, there are no enabled scopes which confirms that the AD Recycle Bin is presently disabled. So to make all this useful, I guess we should turn it on.  So in the same Powershell Window key in this command

ENABLE-ADOPTIONALFEATURE ‘Recycle Bin Feature’ –score forest –target ‘domainfqdn’

You will get a prompt warning you that it will make the change.   Choose “Yes” if you wish to enable this feature or CTRL-C to abort. Once you’re done, it’s active.  To confirm, run the following command again

GET-ADOPTIONALFEATURE –filter {name –like “*”}

And you’ll get a similar response but note

FeatureScope       : {Forest}
Name               : Recycle Bin Feature 
RequiredForestMode : Windows2008R2Forest 
IsDisableable      : False 
ObjectGUID         : 0599c1a6-6f8f-42d4-b9a0-ab2791d4719e 
ObjectClass        : msDS-OptionalFeature 
FeatureGUID        : 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a 
EnabledScopes      : {CN=Partitions,CN=Configuration,DC=energized,DC=energizedtech,DC=com} 
RequiredDomainMode : 
DistinguishedName  : CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=energized,DC=energizedtech,DC=com

You’ll see the “Enabled Scopes” is now covering the domain.

For more information see:

Active Directory Recycle Bin Step-by-Step Guide