Windows Server 2012 R2: Active Directory Recycle Bin Feature
If a system administrator working in the Active Directory environment deletes any object in Active Directory by mistake, the effects can range from lost end-user productivity to broken network functionality. In Windows Server 2003 Active Directory and Windows Server 2008 AD DS, you could recover deleted Active Directory objects through the tombstone reanimation. However, reanimated objects’ link-valued attributes (for example, group memberships of user accounts) which were physically removed and cleared non-link-valued attributes were not recovered. Therefore, administrators could not rely on the tombstone reanimation as a solution.
In Windows Server 2008 R2 there was a feature introduced called the Active Directory Recycle Bin to provide administrators with a way of recovering directory objects that were accidentally deleted. However, using the AD Recycle Bin in Windows Server 2008 R2 environments proved difficult for some administrators because enabling and using this feature could be performed only from the command-line, either by using the Ldp.exe utility or with Windows PowerShell cmdlets.
Windows Server 2012 R2 simplifies this task and makes it easier for the administrators to recover deleted objects. Now you can use the GUI-based Active Directory Administrative Center for both enabling the AD Recycle Bin and recovering deleted objects. Before we do that let's understand about Active Directory object states.
When the AD Recycle Bin feature is enabled in an Active Directory environment, directory objects can be in one of the following four states:
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap9.jpg
1) Live Object – Suppose you create a user account for a user and the user is now logged in with this account. The user account is being used to log in to the computer or it is being used to access the resources from a network. This state of the object is known as Object Live state.
2) Deleted Object – When you delete an object from the Active Directory, it is moved to deleted objects container, but the object’s link-valued and non-link-valued attributes are still preserved. The object can be recovered by restoring it from the AD Recycle Bin (AD Recycle Bin feature should be enabled) if the lifetime of the deleted object has not yet expired. By default, the deleted object lifetime is configured as 180 days. If the object is in a deleted state you can restore the object back to the Active Directory and the object goes to a Live state.
3) Recycled Object- In this state, the object remains in the Deleted Objects container, but most of its attributes are now stripped away. You cannot restore the object from the AD Recycle Bin or by taking other steps, such as reanimating Active Directory tombstone objects when the object is in a recycled state.
4) Removed Object – Once the lifetime of a recycled object is expired, the AD garbage collection process starts by removing the remains of previously deleted objects from the database.
Enabling Active Directory Recycle Bin Feature in Windows Server 2012 R2
The Active Directory Recycle Bin feature is disabled by default in Windows Server 2012 R2. To enable the Active Directory Recycle Bin feature, the forest functional level should be Windows Server 2008 R2 or higher. This means that all domain controllers in your forest must be running Windows Server 2008 R2 or higher. The process of enabling Active Directory Recycle Bin is irreversible; this means that once you enable the Active Directory Recycle Bin you cannot disable it.
To enable the Active Directory Bin Feature on Windows Server 2012 R2 log in with a user account that belongs to the Enterprise Admins or Schema Admins group. From the Server Manager, click on Tools and click Active Directory Administrative Center. Right-click the target domain in the left navigation pane and click Raise the forest functional level.
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap1.jpg
In the below example the Active Directory Forest Functional level is already Windows Server 2012 R2. You have to perform this task only if your organization forest functional level is lower than Windows Server 2008 R2.
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap2.jpg
To check the current Forest functional level of your organization using PowerShell command execute the below command in AD module for Windows PowerShell.
Get-ADForest -Identity prajwal.local
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap15.jpg
If you are looking to raise the forest functional level using PowerShell command, then launch Active Directory Module for Windows PowerShell and execute the below command.
Set-ADForestMode 6 -Identity PRAJWAL.LOCAL (6 – If you want to raise the forest functional level to Windows Server 2012 R2)
Set-ADForestMode 5 -Identity PRAJWAL.LOCAL (5 – If you want to raise the forest functional level to Windows Server 2012)
Set-ADForestMode 4 -Identity PRAJWAL.LOCAL (4 - If you want to raise the forest functional level to Windows Server 2008 R2)
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap10.jpg
Right-click on the target domain and click Enable Recycle Bin. On the confirmation box click OK.
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap3.jpg
Click OK. On the top ribbon click on Refresh icon.
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap4.jpg
To enable the Active Directory Recycle Bin feature using PowerShell command execute the code shown below in AD module for Windows PowerShell.
Enable-ADOptionalFeature –Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=prajwal,DC=local’ –Scope ForestOrConfigurationSet –Target ‘prajwal.local’
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap14.jpg
To verify if the Recycle Bin feature is enabled or not, execute the below command.
Get-ADOptionalFeature -filter *
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap11.jpg
Now we see a new container called Deleted Objects under the target domain. When you delete any object from the Active Directory it moves to Deleted Objects container.
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap5.jpg
Let’s create a test user named TempUser in the Users OU. Right-click the newly created user and click on Delete. When asked for confirmation to delete the user click Yes.
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap6.jpg
To delete the user account from the Active Directory, use the PowerShell command below.
Remove-ADUser -Identity TempUser
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap16.jpg
First, let us search for the object that has been deleted using the PowerShell command.
Get-ADObject -SearchBase “CN=Deleted Objects,DC=prajwal,DC=local” -ldapFilter:”(msDs-lastKnownRDN=*)” – IncludeDeletedObjects –Properties lastKnownParent
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap12.jpg
As said earlier in Windows Server 2012 R2, the Active Directory Recycle Bin feature has been enhanced with a new graphical user interface for users to manage and restore deleted objects. The deleted objects can now be seen in under Deleted Objects container. When you right-click on the deleted object you see four options.
Restore – This option restores the deleted object to the location where it originally located before deletion.
Restore To – With this option you can restore the object to desired container.
Locate Parent – Shows the Container where the object was present before deletion. Use this option to know the original location of object before you use Restore or Restore To.
Properties – Displays the properties of the Object such as Name, Object Class, USN etc.
Right-click the object present in the Deleted Objects container and click on Restore.
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap7.jpg
We see that the user account is restored back to the original location using the Restore Option.
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap8.jpg
To restore the deleted object back to the original location use the PowerShell command.
Get-ADObject -ldapFilter:”(msDS-LastKnownRDN=*)” –IncludeDeletedObjects | Restore-ADObject
http://prajwaldesai.com/wp-content/uploads/2014/03/AD-Recycle-Bin-Feature-In-Windows-Server-2012-R2-Snap13.jpg
