Introducing the Active Directory Recycle Bin in Windows Server 2008 R2
- Prerequisites and Considerations
- How the Active Directory Recycle Bin Works
- Using the Active Directory Recycle Bin
- Viewing Deleted Objects
- Restoring Deleted Objects
- Summary
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Windows Server 2008 R2 includes a new Active Directory Recycle Bin, which you can use to undo accidental deletions for both Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS). The Active Directory Recycle Bin lets you quickly recover objects that were deleted accidentally, and effectively reduces downtime in the event of a data loss. (So you may have a reprieve from one of those "Oh, no!" moments.)
To use the Active Directory Recycle Bin, your environment must meet certain prerequisites. Even if you meet these criteria, however, you still need to do some planning, because using the Active Directory Recycle Bin restricts future use of other features.
This article provides a thorough understanding of how the Active Directory Recycle Bin works, when you can and cannot use it, and how to go about performing tasks related to the Active Directory Recycle Bin. You'll need this information because, despite its virtues, the Active Directory Recycle Bin doesn't have a user-friendly graphic interface.
Prerequisites and Considerations
The Active Directory Recycle Bin requires a forest functional level of Windows Server 2008 R2. That means all domain controllers in the forest must have Windows Server 2008 R2 installed, and all domains in the forest must have a domain functional level of Windows Server 2008 R2.
The Active Directory Recycle Bin is an optional forest-wide feature, which applies to all domains in the forest when enabled. The feature is disabled by default, even if the forest functional level is set to Windows Server 2008 R2. You can enable the Active Directory Recycle Bin by using the Enable-ADOptionalFeature PowerShell cmdlet, which is included with the Active Directory Module for Windows PowerShell in Windows Server 2008 R2.
Before you enable the Active Directory Recycle Bin, take into account this important consideration: Once you turn on the Active Directory Recycle Bin, it cannot be disabled. You may not see this restriction as an issue. However, it prevents you from leveraging another new feature in Windows Server 2008 R2: the ability to roll back or lower domain and forest functional levels. These two features are mutually exclusive: To roll back or lower functional levels, all Active Directory optional features must be disabled. The irony is that the Active Directory Recycle Bin is the only Active Directory optional feature that cannot be disabled once it's enabled. In effect, you cannot roll back or lower functional levels if you enable the Active Directory Recycle Bin.