How to find deleted objects in Active Directory?

Problem

If you do not have the AD Recycle Bin enabled, it is impossible to find out what objects were deleted. You can only find the deleted objects when it causes operational issues.

This post will explain how you can ascertain the deleted objects when you do not have the native Recycle Bin enabled.

Solution

Using RecoveryManager Plus, you can find out the deleted items if you perform the following steps before the tombstone life-time period elapses.

Step 1: Download RecoveryManager Plus and add your domain.

1. Download and install RecoveryManager Plus.
2. Log in to RecoveryManager Plus as an administrator.
3. RecoveryManager Plus will automatically identify your AD domains.
4. The identified domains will appear under account configuration.

   

5. Update the Username and Password of the domain administrator or enterprise administrator.

   

6. Once updated, navigate to the Active Directory tab > Settings > Backup Settings.
7. Select All OUs from the Select OUs to backup field.
8. Select All object types in the Objects to Backup field.
9. Click Save & Run the backup.

   

Step 2: Find the deleted objects

Once the backup is complete, perform the following steps to identify the deleted objects.

1. Navigate to the Active Directory tab > Active Directory > Recycle Bin.
2. Select the domain in which you’d like to find the deleted objects from the Domain drop-down box.
3. The list of all objects that have been deleted will be displayed.

   Note: If your tombstone life-time is 60 days, only the objects that were deleted 60 days prior to the time at which RecoveryManager Plus backed up your AD environment will be displayed.

4. To restore the objects, mark the check-box next to the objects and click Restore.

   Note: Since RecoveryManager Plus was not installed when you deleted the objects, not all attributes of the objects will be restored. Only a few default attributes will be restored. If you do not restore the object within the tombstone lifetime period, you’ll not be able to restore the objects even using RecoveryManager Plus.