{"id":353732,"date":"2010-02-23T04:00:00","date_gmt":"2010-02-23T08:00:00","guid":{"rendered":"tag:blogger.com,1999:blog-1652419620964346731.post-2659333075275094700"},"modified":"2010-02-23T04:00:00","modified_gmt":"2010-02-23T08:00:00","slug":"easily-restore-deleted-active-directory-objects","status":"publish","type":"post","link":"https:\/\/mereja.media\/index\/353732","title":{"rendered":"Easily Restore Deleted Active Directory Objects"},"content":{"rendered":"

Today I walked into the office with a little bit of a shocker. One of the Help Desk users said that his, and another user\u2019s active directory accounts on our parent company\u2019s domain had miraculously vanished. WTF?<\/font><\/strong> The only changes to active directory the previous day was my co-worker was setting up OCS, and that require some schema changes. I am not sure why those schema changes would delete accounts, but whatever, this is the problem I was facing when I walked in (Still no coffee yet either).<\/strong><\/p>\n

Well it turned out to not be that huge of a deal because I found a really awesome free tool that easily finds deleted active directory objects, and with a click of the button restores them. The way active directory deletes objects is pretty cool, and it also makes it relatively easy to recover. According to Petri<\/a>, \u201cWhen an object is deleted from Active Directory, it is not immediately erased, but is marked for future deletion\u2026The marker used to designate that an AD object scheduled to be destroyed is called "tombstone". A tombstone is an object whose IsDeleted<\/strong> property has be set to True<\/strong>, and it indicates that the object has been deleted but not removed from the directory, much like a deleted file is removed from the file allocation table but the data is not actually removed from the drive.\u201d<\/font><\/em><\/p>\n

The tool I used to recover the objects is called ADRestore.net<\/a>. To use it you simply install it on one of your domain controllers, then click Enumerate Tombstones. Find the missing object (User, OU, Computer, Etc) click on it and hit restore. Easy as pie!<\/p>\n

\"ADRestore\"<\/a> <\/p>\n<\/p>\n

Yes! This works on 2008 Active Directory\u2019s as well as 2003. How do I know? Because we are a 2008 native shop! Here is a list of the main features available:<\/p>\n