In order to restore AD objects, including users, you need to enable the Active Directory Recycle Bin feature. (Note that it cannot be disabled after that!)
- Navigate to “Start”, choose “Administrative Tools”, right-click on “Active Directory Module for Windows PowerShell”, and click “Run as Administrator”.
- Check the domain and forest functional modes using the following commands. Both must be Windows Server 2008R2 or higher.
- To enable the Recycle Bin feature, run the following script. Once the Recycle Bin has been enabled, any Active Directory object that is deleted will be stored in the Recycle Bin.
$cfgNameCtx = (Get-ADRootDSE).ConfigurationNamingContext
$recBin = "CN=Recycle Bin Feature,CN=Optional Features,"
$recBin = $recBin + "CN=Directory Service,CN=Windows NT,CN=Services,"
$recBin = $recBin + $cfgNameCtx
$target = (Get-ADDomain).Forest
Enable-ADOptionalFeature -Identity $recBin -Scope ForestOrConfigurationSet -Target $target -Confirm:$false
- To restore one or more Active Directory user accounts, use this script:
$deletedUsers = Get-ADObject -Filter 'name -like "User Name" -and isDeleted -eq $true' -IncludeDeletedObjects
$deletedUsers | Restore-ADObject
- Launch the Active Directory Users and Computers tool to see all the user accounts that were restored.
- Run Netwrix Auditor Object Restore for Active Directory → Click "Next" → Select the period when the changes that you want to roll back were made and click “Next” → Select the rollback source: either state-in-time snapshots taken by Netwrix Auditor or Active Directory tombstones and click “Next” → Wait for the analysis to complete and click “Next”.
- The “Select Changes for Rollback” section will list all changes that occurred in the specified time range. Select the attributes you want to be restored to the previous state by ticking the corresponding checkboxes → To see what changes will be applied to the selected attribute, highlight it and click the “Details” button → Click “Next” and wait for the restore process to complete.
- Review the results of the rollback → Click “Finish” to exit the wizard.