The method involves enabling the AD Recycle Bin in order to be able to restore deleted user objects with the ADAC. Active Directory Recycle Bin can be activated only where all domain controllers are running Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and on Windows Server 2019. You may also want to visit the following interesting articles. What are the merits and demerits of Local System Account and Service Logon Account, how to delete and restore objects using Active Directory Administrative Center, and what are the differences between an Active Directory contact and a user account object?
Note: In Windows Server 2008, you could use the Windows Server Backup feature and ntdsutil authoritative restore command to mark objects as authoritative to ensure that the restored data was replicated throughout the domain. The drawback to the authoritative restore solution was that it had to be performed in Directory Services Restore Mode (DSRM). During DSRM, the domain controller being restored had to remain offline. Therefore, it was not able to service client requests.Furthermore, If the user account lacks assigned Active Directory Recycle Bin access rights, it may lack sufficient access rights for this operation. However, Active Directory Administration Centre or PowerShell will prompt the following error. Moreover, See the guide below on how to Enable AD recycle Bin and restore deleted users.
To fix this issue, you will have to add the user account as a member to the following security groups in Active Directory.
- Domain Admin
- Schema Admin
- Enterprise Admin
See the image below for more information.
In addition, Restart your device for the new policy to apply. Now, with the correct Active Directory Recycle Bin access rights, you can attempt to enable the AD Recycle Bin, and it will be successful.
I hope you found this blog post helpful. Please let me know in the comment session if you have any questions about Active Directory Recycle Bin access rights.