Microsoft has included recovery capabilities with every release Active Directory (AD) from Windows Server 2000 on. There is a saying that has been around in IT for a long time, “An administrator is only as good as their last backup”. This is because accidental deletions of a single user object to the removal of hundreds even thousands of objects from deleting an organizational Unit (OU) are still a common occurrence. The increasing use of identity management systems and the use of scripting to automate administration tasks have also increased the risk of populating the directory with bad data. This may lead to applications not function correctly or even have security and regulatory compliance implications.

Windows Server 2008 R2 introduced an optional feature to include a recycle bin for Active Directory to simplify the restoration of accidentally deleted objects compared to prior native capabilities. Before the 2008 R2 recycle bin Administrators had the following options though they have certain limitations.

Pre-Windows Server 2008 R2

Prior to the release of the Windows 2008 R2 Recycle Bin for Active Directory recovering objects was possible using one of two basic methods, authoritative restore from a backup or tombstone reanimation.

Authoritative Restore using the NTDSUTIL command line tools

Tombstone Reanimation API

Windows Server 2008 Snapshots using the NTDSUTIL command line tools

Windows Server 2008 R2 Active Directory Recycle Bin

Microsoft introduced the Windows Server 2008 R2 recycle bin as an optional feature to improve upon the prior recovery processes. The new recovery option extended upon the tombstone reanimation feature to include all attribute data with restored objects. The 2008 R2 Recycle Bin does not have its own graphical user interface. Administrators can use PowerShell Cmdlets or ldp.exe to perform recovery operations. The feature is not enabled by default and there must be some domain and forest level prerequisites configured prior to enabling the feature. It also changes the way object deletions work.

BeyondTrust PowerBroker Auditor

The Windows 2008 R2 Recycle Bin offers much better protection than any of the prior native methods for the restoration of objects. To utilize the recycle bin, organizations must upgrade both their AD and Exchange environments to the latest versions and functional levels and must have working knowledge of the AD processes and PowerShell Cmdlets. For organizations looking for a more automated, repeatable and risk adverse method for restoration of both AD and GPO objects, or those companies also requiring advanced "undo" capabilities, a third party solution such as the BeyondTrust PowerBroker Auditor offers unparalleled benefits that include the following.