If you have ever wondered where you can find an object that was deleted from the Active Directory or if you ever wished to see the details of your lost objects, this article can help you.
Let’s say you were called in to assist a Systems Administrator that could swear he used to have a specific computer account but now it’s gone and you have to find it – with these instructions, you have the ability to do it!
Before we get started, just a quick reminder. When an object is deleted from Active Directory, it is not immediately erased, and instead it is marked for future deletion. The marker used to designate that an AD object is scheduled to be destroyed is called a “tombstone.” A tombstone is an object whose IsDeleted property has be set to True, and it indicates that the object has been deleted but not removed from the directory, much like a deleted file is removed from the file allocation table but the data is not actually removed from the drive. The directory service moves tombstone objects to the Deleted Objects container, where they remain until the garbage collection process removes the objects (this process is performed every 12 hours by default). The length of time tombstone objects remain in the directory service before being deleted is either 60 days for Windows 2000/2003 Active Directory, or 180 days for Windows Server 2003 SP1 Active Directory (by default).
Just pay attention to one important issue: if you want to review all the object’s attributes, you must have the Active Directory Recycle Bin enabled on the server (Windows Server 2008/R2 – we’ll discuss that in a different article).
Follow the steps below on one of your Domain Controllers where ldp.exe is available. Ldp.exe is built in to Windows Server 2008/R2, or is available as a separate download from Microsoft as part of the Support Tools in Windows Server 2003.
And just to clarify section 10, if I use * as the attribute instead of “distinguishedName”, the output will be:
Now, after you found the deleted object, you can reanimate it, which is a fancy word for restoring the deleted object. Remember that reanimating a deleted object doesn’t immediately restore it to its original properties. For that, you will need to either restore the object from a backup (performing what is called an authoritative restore), use AD Snapshots (a feature found in Windows Server 2008/R2), or use the AD Recycle Bin feature (part of Windows Server 2008 R2).
Those are the steps you need to take in order to find an object that was deleted from the Active Directory. Remember that when an object is deleted from Active Directory, it is not immediately erased, but instead marked for future deletion.