Another great new feature in Quest’s free AD cmdlets 1.2 is ability to locate deleted (tombstoned) Active Directory objects and restore them back.
Locating is very straight-forward: you just add the -Tombstone switch to the Get-* cmdlet of your choice and now your query searches deleted rather than live objects.
Restoring is even easier – all you need is pipeline the deleted objects into Restore-QADDeletedObject
.
And the best thing of all is that this works great with Windows 2003 Active Directory – so you can start taking advantage of the feature right away!
For example:
# List all tombstoned user accounts
Get-QADUser -Tombstone
# Restore accounts deleted from a specific OU
Get-QADUser -Tombstone -LastKnownParent 'OU=People,DC=company,dc=local' | Restore-QADDeletedObject
# Restore accounts deleted today
Get-QADUser -Tombstone āLastChangedOn (get-date) | Restore-QADDeletedObject
# Restore a specific deleted user
Get-QADUser -Tombstone āName 'John Smith*' | Restore-QADDeletedObject
One gotcha to keep in mind is that when objects are tombstoned computer and user objects are stored in AD exactly the same way. This makes Get-QADUser actually return both user and computer objects. Shay found this workaround to make sure that only user objects are returned:
# Return all tombstoned user accounts but no computer objects
Get-QADUser -Tombstone -SizeLimit 0 -ldap '(&(!samAccountName=*$))'
Other Get-* cmdlets which now have these -Tombstone and -LastKnownParent parameters are:
For more information on what a tombstoned object is and how tombstone-based undelete is different from full recovery see Gilās article here.
Like this:
Like Loading...