A long-overdue AD recovery feature, but with a catch.
I recently took Microsoft to task for the lack of an “undo” feature in its Registry Editor. Perhaps an even more serious omission is the lack of an undo capability in Active Directory Users and Computers, given the lengthy process for recovering an accidentally-deleted account or Organizational Unit: rebooting the domain controller into Directory Services Restore Mode, performing an authoritative restore with NTDSUTIL, and restarting the DC again. Ugh. The authoritative restore is not the only method for recovering an accidentally-deleted object. One can also attempt a “tombstone reanimation,” but that method has its own drawbacks, such as not providing for the restoration of any linked attributes. In real life, people make mistakes. The operating systems that we use should facilitate a graceful recovery rather than frustrate it. So it was with great interest that I began digging into a Server 2008 R2 feature called the “Active Directory Recycle Bin.” According to Microsoft, when you restore a deleted user account via the AD Recycle Bin within 180 days of the account’s deletion, you don’t have to reboot the domain controller, and you don’t have to manually recreate all the links that were associated with that account (group memberships for example). Sounds great, right? Unfortunately, there’s a catch. The AD Recycle Bin can only be turned on when you are at the Server 2008 R2 Forest Functional Level: that is to say, every domain controller in the forest (that’s right, not the domain, but the forest) is running Server 2008 R2. For many organizations, that’s going to be quite some time. So be careful making those changes in AD; for the foreseeable future, they’re still going to be a royal pain to undo.
