Caution: Seasoned Domain Admins Only this is Active Directory and Irreversible
“you break it you bought it…”
All domain controllers must be Server 2008R2 (2K8-R2) And Forest Functional level must be 2008R2
If you already have a 2K8-R2 forest installation you can skip the ADprep steps below
First you need your 2K8-R2 media
Copy the folder \support\Adprep to a path on your schema master domain controller
Open a command prompt as Administrator and change your operating path to the local Adprep folder
Then run the adprep /forestprep
You will then be prompted with the following warning. READ IT and if you agree press ”C”
I am going to assume the same server is your schema Infrastructure operations master, if not repeat the steps above to copy the adprep directory from the server installation media.
From the command prompt as Administrator
Then run the adprep /domainprep /gpprep
If you have a RODC Read Only Domain Controller from the command prompt as Administrator
Then run the adprep /rodcprep
If you have AD LDS running those also must be running 2K8-R2
Now to actually enable the Active Directory Recycle Bin
Open Powershell as an Administrator:
(I found it easier to type the initial command and be prompted rather than one long string)
Enable-AdOptionalFeature ‘Recycle Bin Feature’
You will be prompted for the Scope: ForestOrConfigurationSet
You will be prompted for the Target:forest_name.com IN my example Target:ko.internal
You will then be prompted with the following IRREVERSABLE Warning
Select “Y” to perform the operation.
After you type “Y” and hit enter you are returned to the command prompt there is no indication it ran
If in doubt and you run it again it will tell you it is already exists.
Now you can use Powershell to restore items from your AD recycle bin using the following cmds
Get-ADObject to locate the desired object
Restore-ADObject to perform the actual restoration
For Example I delete Kim A from users in AD to restore it I use the command:
Get-ADObject –Filter ‘displayname –eq “Kim A”’ –IncludedDeletedObjects |Restore-ADObject
Using the AD Recycle bin avoids the hassle of tombstones, authoritative restores and also it restores the AD object in a more thorough manner with groups and other information still intact.