Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows 2003 domain and Windows 2003 domain controller.

I accidentally deleted the whole container. The container contains some child container objects group object and some serviceConnectionPoint object. I am looking for a way to undelete it.

I come across this article, which seems to imply that it's possible to restore a just-deleted AD object by reanimating the tombstone object.

I googled a bit and found ADRestore. I tried it and it could successfully restore my child container objects and group object but not the serviceConnectionPoint objects. It looks like it cannot even find any tombstone objects with the objectClass serviceConnectionPoint. Is it a limitation of the tool or is it a limitation in AD? Is there any other commercial tools that can help restoring the deleted AD object reliably?

share|improve this question
What are you using for backups? In the future, I recommend Backup Exec with the AD recovery agent. – KCotreau Jun 13 '11 at 21:55
The Active Directory recycle bin is new to Windows Server 2008 R2 and your domain functional level must be 2008 R2, so unfortunately that's not going to fly for you. Also, tombstone re-animation was never that great anyway as not all attributes were recovered. To answer your immediate question: the best tool to restore a deleted Active Directory object is a system state backup. If you have no backups of such a critical piece of infrastructure such as Active Directory, I'm afraid I have no sympathy. – Ben Pilbrow Jun 13 '11 at 21:55
I only have VM snapshot, which I think it's a bad idea to be used for restoring AD. What kind of backup tools do you recommend? – Harvey Kwok Jun 13 '11 at 21:57
If you don't want to shell out for a commercial backup utility, Windows comes with a perfectly functional one baked in. – Ben Pilbrow Jun 13 '11 at 22:00
Fair enough, but it does do what it says on the tin and will produce a consistent Active Directory backup. If you want the granularity or extra features then you go and buy the commercial software with the bells and whistles that you want. It's all about the trade-off you want to make. – Ben Pilbrow Jun 13 '11 at 22:12
up vote 4 down vote accepted

Put one of your DCs in recovery mode and restore from backup.

As @Holocryptic pointed out, here's the link to that:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.