In this tutorial, you will learn how to enable the Active Directory Recycle bin on Windows Server 2016.
I’ll show you how to enable it through the GUI as well as with Powershell.
The AD recycle bin comes in handy when you accidentally delete an AD object and need to restore it.
The AD Recycle bin allows you to quickly restore deleted objects without the need of a system state or 3rd party backup.
The recycle bin feature preserves all link valued and non link valued attributes. This means that a restored object will retain all it’s settings when restored.
By default, a deleted object can be restored within 180 days. This time is controlled by the Deleted Object Lifetime (DOL) which can be set on the msDS-deletedObjectLifetime attribute.
In addition, it’s default value is the same as the Tombstone Lifetime.
Just remember the default setting to restore a deleted object is 180 days.
If you want a deeper dive into these settings then check out this Microsoft Blog Post.
Note: Once you enable the Active Directory Recycle Bin you can’t turn it off.
All done, AD recycle bin is now enabled.
Here is an example using the ad.activedirectorypro.com domain.
Notice the enabled scope, if it was not enable the scope would be empty.