Active Directory Recycle Bin: How to Enable and Recover Deleted Objects

Someone deletes the wrong user account, or worse, drags an entire OU into oblivion during a tidy-up. Without the Active Directory Recycle Bin, getting that back means booting a DC into DSRM and running an authoritative restore — a tense, slow process. With the Recycle Bin enabled, it’s a one-line restore that brings the object back live, group memberships and all, in seconds.

The catch is that the Recycle Bin only helps if you turned it on before the deletion. It doesn’t reach back in time. So this is one of those features you enable on a quiet Tuesday and hope you rarely need, rather than reaching for it in a panic.

This guide covers the prerequisites, how to enable it (and why that’s a permanent decision), and the two ways to recover deleted objects — PowerShell for speed and the Active Directory Administrative Center for a point-and-click restore.

How the Recycle Bin changes deletion#

To understand why the Recycle Bin matters, it helps to know what happens when you delete an AD object without it. Normally a deleted object becomes a tombstone: most of its attributes — group memberships, profile data, the things that make the account usable — are stripped away immediately. You can technically “reanimate” a tombstone, but you get back a shell that you then have to rebuild by hand.

With the Recycle Bin enabled, a deleted object instead keeps all its attributes for the duration of the deleted object lifetime. Restoring it returns a fully intact object to its original location. No rebuilding group memberships, no recreating attributes — it’s the object you deleted, brought back whole.

Prerequisites#

Two things have to be true before you can enable the Recycle Bin:

• Forest functional level of Windows Server 2008 R2 or higher. This means every DC in the forest must run 2008 R2 or later. Check it first:

Get-ADForest | Format-List ForestMode

• Enterprise Admins rights, because enabling the feature is a forest-wide change.

If your forest level is below 2008 R2, you’ll need to retire any older DCs and raise the level first. Raising the functional level is itself one-way, so confirm no legacy DCs remain — the same caution applies when you migrate Active Directory from 2012 R2 to 2022.

Enable the Recycle Bin#

With the prerequisites met, enabling it is a single cmdlet. Scope it to your forest and confirm the prompt:

Enable-ADOptionalFeature `
  -Identity "Recycle Bin Feature" `
  -Scope ForestOrConfigurationSet `
  -Target "corp.local"

You can also do it from the Active Directory Administrative Center (ADAC): select the domain, and in the Tasks pane click Enable Recycle Bin. Either way, allow time for the change to replicate to all DCs before you rely on it.

Recover a deleted object with PowerShell#

This is the fast path. First, find the deleted object using Get-ADObject with the -IncludeDeletedObjects switch — deleted objects are hidden from normal queries, so you need it explicitly:

# Find a deleted user by name
Get-ADObject -Filter 'Name -like "*Jane Smith*"' -IncludeDeletedObjects |
  Select-Object Name, ObjectGUID, LastKnownParent

The LastKnownParent column shows where the object will return to. Once you’ve found it, restore it by piping to Restore-ADObject:

# Restore a single deleted user
Get-ADObject -Filter 'SamAccountName -eq "jsmith"' -IncludeDeletedObjects |
  Restore-ADObject

The account comes back live, in its original OU, with its group memberships and attributes intact. No DSRM, no reboot, no rebuild.

Restoring a whole OU and its contents#

If an entire OU was deleted, order matters: you can’t restore a child object into a container that doesn’t exist yet. Restore the parent OU first, then its children.

# 1. Restore the deleted OU itself first
Get-ADObject -Filter 'Name -eq "Sales" -and ObjectClass -eq "organizationalUnit"' -IncludeDeletedObjects |
  Restore-ADObject

# 2. Then restore the objects that were inside it
Get-ADObject -Filter 'LastKnownParent -like "*OU=Sales*"' -IncludeDeletedObjects |
  Restore-ADObject

Recover with the Administrative Center (GUI)#

If you’d rather click than script, the Active Directory Administrative Center gives you a Deleted Objects container:

1. Open Active Directory Administrative Center.
2. Select your domain, then open the Deleted Objects container.
3. Find the object you want, right-click it, and choose Restore (restores to its original location) or Restore To… (lets you pick a different OU).

The GUI is the friendlier option when you’re recovering a handful of items or aren’t sure of an object’s exact name, and it deals with parent/child ordering for you. For bulk restores or scripted recovery, PowerShell is quicker.

Recycle Bin vs authoritative restore#

The Recycle Bin doesn’t replace your backups — it sits alongside them. Each covers a different situation:

Wrapping up#

The Active Directory Recycle Bin turns one of the scarier admin mistakes — deleting the wrong account or OU — into a quick, low-stress fix. Confirm your forest is at 2008 R2 or higher, enable the feature (knowing it’s permanent), and learn the Get-ADObject -IncludeDeletedObjects into Restore-ADObject pattern before you ever need it.

The one rule to remember: it only protects deletions that happen after you enable it. So enable it now, on a quiet day, rather than wishing you had during an incident. Keep your system state backups going for everything the Recycle Bin can’t cover, and you’ve got AD object recovery handled from both ends.