title: How to query for LDAP (Active Directory) deleted objects since a given time?
body: <p>I need to query for incremental changes from an Active Directory forest using LDAP.</p>
  
  <p>The easy part is to query for incremental updates of objects, and for creation of new objects. For this you can use the <code>whenChanged</code> property </p>
  
  <p>Example: </p>
  
  <pre><code>(&amp;(objectClass=user)(whenChanged&gt;=20180501000000.0Z))
  </code></pre>
  
  <p>So far, so good. </p>
  
  <p>But what about querying for deleted records. Is there some way to query LDAP for all items deleted since a given time?</p>
  
  <p>I do know about the fact that Active Directory marks objects for deletion (doesn't actually delete stuff). And I know there is some way to get deleted objects: (<a href="https://social.technet.microsoft.com/Forums/office/en-US/72bfed4b-898f-466d-ab8c-e631f721280b/retrieving-deleted-user-from-ad-by-using-ldap-query?forum=winserverDS" rel="nofollow noreferrer">See this msdn post</a>)</p>
  
  <p>But I haven't had much luck creating an LDAP query that, against a very vanilla active directory server, can get a list of deleted accounts.</p>
  
  <p>Related: <a href="https://stackoverflow.com/questions/46360778/ldap-query-for-deleted-users">LDAP query for deleted users</a></p>
  
  <p>I tried that suggestion too:</p>
  
  <pre><code>(&amp;(isDeleted=TRUE)(userAccountControl:1.2.840.113556.1.4.803:=512))
  </code></pre>
  
  <p>Still Nothing.</p>
  
  <p>How can I make this work? </p>