How to Enable and Configure the Active Directory Recycle Bin

The Perils of Accidental Deletion

In a standard Windows Server environment, deleting a user account, computer object, or security group in Active Directory is an immediate and highly destructive action. By default, once an object is deleted, it is completely stripped of its attributes and moved to a hidden tombstone container. Restoring it requires complex authoritative restore procedures using command-line tools and a system state backup, meaning the user loses all their group memberships and permissions in the process.

To solve this, Microsoft introduced the Active Directory Recycle Bin. When enabled, deleted objects are preserved with all of their attributes, group memberships, and passwords completely intact for 180 days. You can restore them with a single click.

Step 1: Check the Forest Functional Level

To enable the Recycle Bin, your Active Directory Forest Functional Level must be at least Windows Server 2008 R2. To check this, open the Active Directory Domains and Trusts console. Right-click the root node (Active Directory Domains and Trusts) in the left pane and select Properties. Verify the Forest functional level is high enough.

Step 2: Enable the Recycle Bin via the Active Directory Administrative Center

The easiest way to enable the feature is through the modern GUI:

1. Open the Server Manager and click Tools > Active Directory Administrative Center (ADAC).
2. In the left-hand navigation pane, click on the name of your local domain (e.g., yourdomain.local).
3. Look at the Tasks pane on the far right side of the window. Click on the option titled Enable Recycle Bin…

A warning will appear informing you that once the Recycle Bin is enabled, it cannot be disabled. Click OK to proceed, and then click OK on the subsequent message asking you to refresh the ADAC console.

Step 3: Enable the Recycle Bin via PowerShell (Alternative)

If you prefer automation, you can enable the feature using a single PowerShell command. Open PowerShell as an Administrator and execute the following cmdlet (replace yourdomain.local with your actual domain name):

Enable-ADOptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target 'yourdomain.local'

Press Y when prompted to confirm the permanent change.

Step 4: How to Restore a Deleted Object

Once enabled, recovering a deleted user is incredibly simple.

1. Open the Active Directory Administrative Center.
2. Click on your domain name in the left pane.
3. You will now see a new container named Deleted Objects. Double-click to open it.
4. Find the user or object you accidentally deleted, right-click it, and select Restore.

The user will instantly reappear in their original Organizational Unit (OU) with all of their permissions, group memberships, and passwords perfectly intact.