In this tutorial, you will learn how to enable the Active Directory Recycle bin on Windows Server 2016.
I’ll show you how to enable it through the GUI as well as with Powershell.
The AD recycle bin comes in handy when you accidentally delete an AD object and need to restore it.
Active Directory Recycle Bin Benefits
The AD Recycle bin allows you to quickly restore deleted objects without the need of a system state or 3rd party backup.
The recycle bin feature preserves all link valued and non link valued attributes. This means that a restored object will retain all it’s settings when restored.
By default, a deleted object can be restored within 180 days. This time is controlled by the Deleted Object Lifetime (DOL) which can be set on the msDS-deletedObjectLifetime attribute.
In addition, it’s default value is the same as the Tombstone Lifetime.
Just remember the default setting to restore a deleted object is 180 days.
If you want a deeper dive into these settings then check out this Microsoft Blog Post.
RECOMMENDED: SOLARWIND ADMIN BUNDLE (FREE TOOL)
This is a bundle of 3 FREE Tools for Active Directory.
- Bulk import users tool
- Inactive Computer Account Removal Tool
- Inactive User Account Removal Tool
Simplify administration and keep Active Directory secure with this trio of FREE tools.
Steps to Enable the AD Recycle Bin on Windows Server 2016
Note: Once you enable the Active Directory Recycle Bin you can’t turn it off.
Follow these simple 3 steps:
Step 1: Open Server Manager
Step 2: Open the Active Directory Administrative Center
From the Server Manager go to tools and select Active Directory Administrative Center
Step 3: Enable Recycle Bin
Within the Active Directory Administrative Center click on your local domain then click on “Enable Recycle Bin”
Click OK to confirm
Click OK on the next pop up
All done, AD recycle bin is now enabled.
Enable AD Recycle Bin with PowerShell
Follow these step to enable the recycle bin with PowerShell
Step 1. Logon to your Domain Controller
Step 2: Load the AD Powershell module
Step 3: Run the following cmdlet to enable the Recycle Bin
Enable-ADOptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target <your forest root domain name>
Here is an example using the ad.activedirectorypro.com domain.
Enable-ADOptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target ad.activedirectorypro.com
How to Verify AD Recycle Bin is enabled
Use this Powershell command to verify it is enabled
Get-ADOptionalFeature -filter *
Notice the enabled scope, if it was not enable the scope would be empty.
Recommended Tool: SolarWinds Server & Application Monitor (SAM)
This utility was designed to Monitor Active Directory and other critical applications. It will quickly spot domain controller issues, prevent replication failures, track failed logon attempts and much more.
What I like best about SAM is it’s easy to use dashboard and alerting features. It also has the ability to monitor virtual machines and storage.