Windows Server 2025 / How to Enable AD Recycle Bin and Restore a Test Object

Active Directory Recycle Bin can restore eligible directory objects deleted after activation with their attributes and memberships. Enabling it is a forest-wide change that cannot be disabled afterward, and it does not replace backup for every object or recovery scenario.

Check scope and recovery conditions

This feature restores AD users, groups, or OUs, not file-server content, an entire SYSVOL, or the operating system. Recycle Bin guidance explains activation and supported recovery.

Check functional levels, replication, backups, and authorized change permissions. Production activation requires a planned forest change; this exercise applies only to the isolated lab.

Get-ADForest | Select-Object RootDomain,ForestMode
Get-ADOptionalFeature -Filter "Name -eq 'Recycle Bin Feature'" | Select-Object Name,EnabledScopes
repadmin /replsummary

Enable it in Administrative Center

1. Open dsac.exe on DC1 or the management PC.
2. Confirm the intended ad.example.test forest.
3. Choose Enable Recycle Bin and read the irreversible-change confirmation.
4. Apply only to the intended lab and refresh the console.
5. Verify replication of the configuration across both DCs.

Skip activation if it is already enabled. A disabled menu can reflect current state, functional levels, or permissions. See Administrative Center guidance and do not assume both controllers immediately converge.

Create a dedicated recovery object

After activation and replication, create a new disabled account named recycle.lab, only if absent. LabUsers and GG_LabUsers must already exist. Do not use a real user or administrator:

New-ADUser -Name 'Recycle Lab User' -SamAccountName 'recycle.lab' -Path 'OU=LabUsers,OU=Lab,DC=ad,DC=example,DC=test' -Description 'Recycle bin practice only' -Enabled $false
Add-ADGroupMember -Identity 'GG_LabUsers' -Members 'recycle.lab'
$recycleTest = Get-ADUser -Identity 'recycle.lab' -Properties MemberOf
$recycleTest | Select-Object Name,ObjectGUID,SID,DistinguishedName,MemberOf

Record its GUID, security identifier (SID), OU, and memberships. Disabled is deliberate because the account is not for sign-in. Recreating the same display name would not preserve the same identity.

Delete and restore only the identified object

Use the single GUID retained in the same session. Review the displayed Recycle Lab User identity at the confirmation prompt, rather than piping a broad search into deletion:

Remove-ADUser -Identity $recycleTest.ObjectGUID -Confirm
Get-ADObject -Identity $recycleTest.ObjectGUID -IncludeDeletedObjects -Properties isDeleted,lastKnownParent | Select-Object Name,ObjectGUID,isDeleted,lastKnownParent
Restore-ADObject -Identity $recycleTest.ObjectGUID

The GUI alternative is Deleted Objects in Administrative Center. If the original parent is missing, restore that parent or choose an appropriate location. Check name conflicts before recovery.

Compare the restored identity

Get-ADUser -Identity 'recycle.lab' -Properties MemberOf,Enabled | Select-Object Name,ObjectGUID,SID,Enabled,DistinguishedName,MemberOf
Get-ADGroupMember -Identity 'GG_LabUsers'

Compare GUID, SID, location, and membership with the original record. The account should remain disabled, and both controllers should show the same object after replication.

Retention is finite. If recovery is unavailable, investigate appropriate backups before recreating a same-named but differently identified account. You may clean up only the dedicated test object afterward; disabling the Recycle Bin itself is not an available rollback.