Active Directory Recycle Bin.
The AD Recycle Bin is super useful to help you recover
deleted AD user and group accounts.
Why?
Well, let's face it,
an employee may leave your company and one of your colleagues
may think they're doing a great thing by deleting that user
account from Active Directory.
Maybe they don't know that you have a compliance requirement to keep
those deleted accounts, just you should disable them,
let's say.
Well, how can you recover them?
Well,
it used to be back in the earlier days of Active Directory
that you'd need to reboot a domain controller into
Directory Services Restore Mode,
perform what's called an authoritative restore of the deleted object,
and then force replication to ensure that all domain controllers get a
copy of it. Yeah, it's a lot easier nowadays with the Recycle Bin. The
retention attributes in the Active Directory schema are important for
you to know for the exam. The formal attributes is
msDS‑deletedObjectLifetime, and you set that, it uses as its default the
value of another attribute,
tombstoneLifetime. Now from Windows Server 2003 forward, that
default is 180 days. You can raise it if you want to.
And that's basically the retention period that if you delete a user or group,
it's not going to be until day 181 that the Active Directory garbage
collection process permanently purges that account.
So that's a pretty good length of time.
Now, the Recycle Bin is disabled by default.
It's a one‑way operation because it involves a modification of the Active
Directory schema. And if you're cognizant or aware of how the schema works
historically from the very beginning in Windows 2000 Server, the schema allows
you to extend it, and then if you don't need an extension, you can disable it or
deactivate it, but you cannot remove it.
It's a one‑way operation.
We managed the AD Recycle Bin using the Active Directory
Administrative Center if you want a GUI tool. Actually, the
ADSI Edit MMC console is another GUI tool.
Less user‑friendly for sure than ADAC.
And then, of course, there's Windows PowerShell. In the demo,
I will use Administrative Center, but I want to go over the PowerShell here,
just for completeness and just with that theme on AZ‑800 and
801 relying on Windows PowerShell a lot.
You really can't have enough PowerShell, in my humble opinion.
First bit of code here is showing us how to enable the AD Recycle Bin.
We're using Enable‑ADOptionalFeature on one of our domain
controllers, and you're specifying your scope with your domain
name, all right? To restore a deleted user, this example is
capitalizing on the PowerShell pipeline.
We're doing a Get‑ADObject, running a Filter script to grab Marc Brown, and
then once that IncludeDeletedObjects is critical because that's the way that we
can surface Marc, as long as, A, the account is in the Recycle Bin, and B, the
tombstone lifetime hasn't yet elapsed.
And then the pipe character allows us to take that resolved object and then
restore it. Simple as that. And then to set a new default tombstone
lifetime using PowerShell in this example, again,
there's always multiple ways to accomplish any of these
goals, the Enable‑ADOptionalFeature,
that's pretty much it as far as enabling AD Recycle Bin. And it's true
that to query the Recycle Bin, you'll use Get‑ADObject, but you can go
a number of different specific ways.
Longer, shorter ways around.
In this example, we're creating a reference to the domain forest route, and
then we need the distinguished LDAP syntax to that domain, and we're storing
those as variables, and then we're doing Set‑ADObject, just patching in
using Replace, a new key‑value pair,
tombstoneLifetime is the name of the attribute. In this example, we're extending it to 360 days