Friday, August 26, 2011

Restore Active Directory Deleted Accounts Windows Server 2008 R2

After experiencing deleted login accounts and passwords from Active Directory. I used the following solution to recover domain accounts. this does not recover passwords assigned nor active directory groups they were previous assigned to, this will need to be done manually after the restore.

From Active Directoy Server >

Start > Run> ldp.exe

Connection > Connect > OK

Connection > Bind > OK

{Should and error occur on Connect command or Bind command, this is another issue entirely}

View > Tree

BaseDN: this is where you will enter your domain name as follows: DC="your domain",.DC="com" without quotes

Expand Tree View > CN=Deleted Objects,DC=your domain,DC=com

Double Click on the Deleted Objects to display domain accounts delelted from AD
Highlight and right click on the deleted domain account you want to recover, in the selection field choose, Modiy.

You will now see the DN: field populated with the information from the Tree View
In the "EDIT ENTRY ATTRIBUTE" Field enter without the quotes, " isDeleted " just as typed.,

In the " VALUES " field there will be no data entered here.

Operation buttons, select " Delete " and then select the Enter Button, this will place the data into the Entry List field and will also designate that this data recorded for the AD account is currently in a deleted state.

Now do the following:
In the "EDIT ENTRY ATTRIBUTE" Field enter without the quotes, " distinguishedName " just as typed

In the " VALUES " field you will now enter the information to restore this back into AD. If I had a user Bob Smith in a OU called Employees then the following would be correct
CN=Bob Smith, ou=Employee,dc=your domain,dc=com

(If you have not created any additional OU's in your AD environment then you can leave out the ou= input and simply use dc=your domain, dc=com.)

Operation is now set to " Replace ", (remember, first is Delete, now set to Replace), click on the Enter button, this will now populate the Entry List field.
I had both the Synchronous and Extended options selected

Click on RUN, you should see log information now as to the account being recreated back into your AD, you will need to refresh the AD window in order to "see" the new account replaced, you will need to re-enable this account, reset password, and then add back the AD groups this account was a member of.

Website address which goes into greater detail
http://technet.microsoft.com/en-us/library/dd379509(WS.10).aspx#BKMK_1



0 Comments:

Post a Comment

<< Home