If you are in a Active Directory environment with Windows 2008 R2 (or newer) domain controllers, then you can recover deleted objects without the limitations of the older windows versions. This is a new feature which is called AD Recycle Bin.
All attributes, group memberships and other references can be restored. If you use this feature, you can undelete entire OUs which was deleted before without the need to restore some AD data from a backup! You can read more about this new AD feature on the Microsoft Technet Article 'Step-by-Step Guide to the AD Recycle Bin'.
The important thing about the AD Recycle Bin: This feature has to be activated first! Even in pure Windows 2008 R2 DC environments, you have only the 'old' tombstone reanimation if you don't activate the AD Recycle Bin feature. See the explanations below ho to activate the AD Recycle Bin.
If the AD Recycle Bin is activated, the deleted objects in your domain are stored in the Deleted Objects container, which is a container in the root hierarchy of each domain. You cannot see this container with the normal AD admin tools because it's a special hidden container which is only visible in LDAP requests with the extended LDAP control 1.2.840.113518.104.22.1687 (Show Deleted) - fortunately LEX can use this control in it's request to the regarding server.
Objects in the Deleted Objects container can have two different states:
Both timespan parameters can be set globally in the configuration partition object
CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=yourdomain,DC=com
with the attributes
msDS-deletedObjectLifetime and tombstoneLifetime
If there is no attribute, then the default values are in effect (180 days), you can add these attribute with you own setting if you want to change the settings. Please note that large lifetime values causes big AD databases on the file system on all domain controllers in the entire forest!
If you want to reanimate the tombstone of a recently deleted object, you have to select the Deleted Objects container in the regarding domain. In the object list panel, you see all the deleted objects in this container on the same level (there are never subcontainer structures in the deleted objects container).
All deleted objects become a tombstone where the relative distinguished name (RDN) is the old object name, together with a line feed (strange but not illegal in a directory name) and the GUID string of this object. There are several interesting attributes for the tombstones:
Select all the objects you want to recover and use the menu option Edit - Undelete (also available in the context menu). The Object Undelete dialog appears:
In this dialog, you can choose if you want to restore the deleted objects in their original or another container. If you choose to restore the object in their original container, LEX can restore these containers to if this should be necessary. After the undelete operation you see the results in a separated window:
The option Copy to Clipboard enables you to get a semicolon-separated result summary into the clipboard so that you can use this for documentation of the recovery operation.
You can check whether the AD Recycle Bin Feature was enabled in your Active Directory forest or not. Just browse into the Configuration Partition (this namespace is offered by any DC in your environment). There you have to go to this object
There is an attribute named
If the AD Recycle Bin is active, this attribute has this value
CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,
Unfortunately, you cannot simply set this attribute directly if you want to activate the Recycle Bin Feature. Instead, you have to enable the feature by writing to the RootDSE entry of the regarding server. You have to be enterprise admin for this.
So open the RootDSE entry with the LEX option Connection - RootDSE. After that, you see the attribute window for this entry. Now you have to add an additional attribute named EnableFeature. In fact, this is not a real attribute, but writing to 'EnabledFeature' can activate the Ad Recycle Bin on a domain controller. The value that has to be written is the GUID of the AD Recycle Bin Feature:
You can read more about the special RootDSE attributes which changes the DC's behavior in the MSDN article about the RootDSE Modify Operations.