Restore Deleted Active Directory Objects with Recycle Bin

Admin

October 10, 2026

8 min read

Active Directory Recycle Bin can restore objects deleted after the feature was enabled, including their attributes and group memberships. This walkthrough uses the ActiveDirectory PowerShell module to check feature status, find one deleted user, preview the operation, and validate the result. Run recovery work with an approved account and a change record.

Check Functional Levels and Feature Status

Preflight

Run these read-only checks from an elevated PowerShell session with the ActiveDirectory module. The forest and domain functional levels must be Windows Server 2008 R2 or higher to enable the feature. Record the forest’s domain naming master because the enable operation must be directed to that role holder.

Import-Module ActiveDirectory
$forest = Get-ADForest
$domain = Get-ADDomain
$feature = Get-ADOptionalFeature -Filter 'Name -eq "Recycle Bin Feature"' -Properties EnabledScopes

$forest | Select-Object Name, ForestMode, DomainNamingMaster
$domain | Select-Object DNSRoot, DomainMode
$feature | Select-Object Name, EnabledScopes

Enable the Feature Only If the Forest Owner Approves

Lab or Approved Change

If the feature is already enabled, skip this step. In a lab, or after an approved production change, enable it for the forest using the name and domain naming master discovered in Step 1. You must have the required administrative rights and supported functional levels.

if ($feature.EnabledScopes) {
  Write-Output 'Active Directory Recycle Bin is already enabled; no forest change was made.'
} else {
  Enable-ADOptionalFeature `
    -Identity 'Recycle Bin Feature' `
    -Scope ForestOrConfigurationSet `
    -Target $forest.Name `
    -Server $forest.DomainNamingMaster `
    -Confirm
}

Find and Identify Exactly One Deleted User

Locate the Object

Use a distinctive account name and inspect the results before restoring anything. The example searches by sAMAccountName; replace lab.user with the exact account identifier. A search returning zero or multiple results should stop the procedure.

# Use a writable DC in the deleted user's original domain for each recovery command.
$recoveryDC = (Get-ADDomainController -Discover -DomainName $domain.DNSRoot -Writable).HostName
$deletedUsers = @(
  Get-ADObject -Server $recoveryDC -Filter 'isDeleted -eq $true -and objectClass -eq "user" -and sAMAccountName -eq "lab.user"' `
    -IncludeDeletedObjects `
    -Properties objectClass, objectGUID, lastKnownParent, whenChanged, isRecycled |
    Where-Object { -not $_.isRecycled }
)

if ($deletedUsers.Count -ne 1) {
  throw "Expected one deleted object; found $($deletedUsers.Count). Stop and refine the search."
}

$deletedUsers | Select-Object Name, ObjectClass, ObjectGUID, LastKnownParent, WhenChanged

❯ Illustrative Output (Results Vary)

Verify the account, object class, available change/deletion evidence, and original parent before proceeding. WhenChanged is not an authoritative deletion audit timestamp.

Preview the Restore Operation

WhatIf Review

Use the object’s GUID from the exact result rather than a broad name filter. -WhatIf shows the intended operation without restoring the object. If the original OU no longer exists, identify and review an existing target OU before using -TargetPath.

Restore-ADObject -Server $recoveryDC -Identity $deletedUsers[0].ObjectGUID -WhatIf

# Optional alternative: uncomment and use this only if the original parent is unavailable.
# Restore-ADObject -Server $recoveryDC -Identity $deletedUsers[0].ObjectGUID -TargetPath 'OU=Recovery,DC=example,DC=com' -WhatIf

Restore the User After Reviewing the Target

Recovery

After confirming the GUID and destination, restore the object to its last known parent or to the approved target OU. The example prompts for confirmation. Keep the original backup and change record according to your recovery process.

# Choose this command to restore the object to its last known parent:
Restore-ADObject -Server $recoveryDC -Identity $deletedUsers[0].ObjectGUID -Confirm

# If the original parent is unavailable, use this reviewed OU command instead:
# Restore-ADObject -Server $recoveryDC -Identity $deletedUsers[0].ObjectGUID -TargetPath 'OU=Recovery,DC=example,DC=com' -Confirm

Verify the Account and Group Memberships

Validation

Confirm the account exists at the intended location, check its enabled state and sign-in name, and compare group memberships with the recovery request. Recycle Bin preserves the deleted object’s attributes and linked values, but application access and downstream replication should still be tested.

Get-ADUser -Server $recoveryDC -Identity $deletedUsers[0].ObjectGUID -Properties Enabled, UserPrincipalName, DistinguishedName |
  Select-Object SamAccountName, Enabled, UserPrincipalName, DistinguishedName

Get-ADPrincipalGroupMembership -Server $recoveryDC -Identity $deletedUsers[0].ObjectGUID |
  Sort-Object Name |
  Select-Object Name