Active Directory Recycle Bin

Focus: Active Directory Recycle Bin

Active Directory Recycle Bin

This is a new feature of Windows 2008 R2 which is disabled by default. This feature will be available only if your forest functional level is Windows 2008 R2 and above. Once you enable this feature, it cannot be disabled.

How to enable?

• There is no GUI to enable AD recycle bin
• Open powershell execute the below:
• Import-Module ActiveDirectory
• Enable-ADOptionalFeature -Identity "Recycle Bin Feature" -Scope ForestOrConfigurationSet -Target "globomantics.local" -whatif

What makes AD Recycle Bin special ?

Normal Deletion process : An object is deleted, it is moved to Deleted Objects container after changing the object attribute IsDeleted to True (Tombstoning). Most of the attributes of the object will be striped off at this point. The striped off object could be retained during TSL and will be deleted permanently after TSL.

AD Recycle Bin process :  All the above process stands correct for AD recycle bin as well but except the attribute striping. When an AD object is deleted with recycle bin enabled, the system preserves all of the object's attributes.

In short, if you want the  attributes of the deleted objects to be available after tombstone reanimation, enable AD recycle Bin.

AD Recycle Bin process

• An object has been removed from AD and it is now 'logically deleted' from AD
• The deleted object is moved to Deleted Objects container and will remain in the container throughout the duration of the Deleted object lifetime. Within this period the object can be recovered using AD recycle bin or authoritative restore
• After the deleted object lifetime period, the logically deleted object will become recycled object (which is same as a Tombstoned object).
• The recycled object will remain in Deleted Container until the Recycled object lifetime expires after which the object will be physically deleted with the help of garbage collection process.