Advanced Windows PowerShell Scripting Video Training

Advanced Windows PowerShell Scripting Video Training
Advanced Windows PowerShell Scripting Video Training

Wednesday, September 8, 2010

How to control how long an object is recoverable in the AD Recycle Bin.

The active Directory Recycle Bin is your tool to recover a deleted object, and all it’s associated properties. An object is only recoverable for a certain length of time. You can configure this period of time to meet your organizations needs. First you need to turn on the AD Recycle Bin. The command below will do this:

Enable-ADOptionalFeature –Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=Your forest root domain’ –Scope ForestOrConfigurationSet –Target ‘Your forest root domain

Once you have turned it on, any object delete after this point can be recovered. By default, the retention period is 180 days. To control the amount of time that you have to execute the recovery:

Set-ADObject -Identity "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=" -Partition "CN=Configuration,DC=" -Replace:@{"msDS-DeletedObjectLifetime" = }

On a final note, remember that this is a Windows Server 2008 R2 feature.

http://blogs.technet.com/b/askds/archive/2009/08/27/the-ad-recycle-bin-understanding-implementing-best-practices-and-troubleshooting.aspx

No comments: