Sanu VargheseIT & AI notes
Tutorials › Windows Server
BeginnerWindows Server · about 15 min · 25 October 2026

Turn on the Active Directory Recycle Bin and restore a deleted user

Someone deletes a user account or a whole OU by mistake. Without the Active Directory Recycle Bin, getting it back means an authoritative restore from backup. With it switched on, you can restore the object in a few clicks.

Before you start

  • The forest functional level must be Windows Server 2008 R2 or higher.
  • You must be a member of Enterprise Admins.
  • Enabling it makes the NTDS.DIT database on every domain controller bigger, and it keeps growing over time. Check you have disk space on your DCs.
This can't be undone. Once the Recycle Bin is enabled, it can't be disabled. Also, anything deleted before you enable it can no longer be recovered through the Recycle Bin. The only way back for those objects is an authoritative restore from a backup taken before you enabled it. If you've just deleted something important, deal with that first.

Part 1: Enable the Recycle Bin in Active Directory Administrative Center

  1. Sign in to a domain controller (or a machine with RSAT) with an Enterprise Admins account.
  2. Open Active Directory Administrative Center.
  3. In the left-hand navigation pane, select the name of your forest root domain.
  4. In the Tasks pane on the right, select Enable Recycle Bin. If it's greyed out, either it's already on or your forest functional level is too low.
  5. The Enable Recycle Bin Confirmation dialog warns that this is irreversible. Select OK.
  6. A second dialog says the Recycle Bin won't work fully until every domain controller has replicated the change. Select OK.

Or do it with PowerShell

Run this in an elevated PowerShell window. Microsoft says it must be run against the domain controller that holds the domain naming master FSMO role. Replace the forest and server names with yours.

$params = @{
    Identity = 'Recycle Bin Feature'
    Scope    = 'ForestOrConfigurationSet'
    Target   = 'contoso.local'
    Server   = 'DC01'
}
Enable-ADOptionalFeature @params

Part 2: Restore a deleted object

  1. In ADAC, select your domain name in the navigation pane.
  2. In the middle list, double-click Deleted Objects.
  3. Find the object. Right-click it and select Restore (or select Restore in the Tasks pane). It goes back to where it was.
  4. To put it somewhere else, for example if its OU was also deleted and you don't want that back, select Restore To and pick a container.
  5. To restore several objects, hold Ctrl and select them, then select Restore.
If a whole OU was deleted, restore the OU first, refresh ADAC, then restore the objects inside it. If you restore a child first you'll get: The operation could not be performed because the object's parent is either uninstantiated or deleted. After refreshing, the children's Last Known Parent changes to the restored OU, which shows it's safe to carry on.

Check it worked

  • In ADAC, select the forest name again. Enable Recycle Bin should now be greyed out, because it's already on.
  • Wait for replication, then test: create a test user in a test OU, delete it, and check it appears under Deleted Objects.
  • Restore the test user and confirm it's back in its OU. Then delete it again.

Sources

← All tutorials
Esc