Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a need to find a username that was deleted from the AD using only the SID. I understand that Windows AD leaves being a Tombstone file that might contain this information. Can someone give me the syntax of a command or post a document that might point me in the right direction?

share|improve this question
up vote 4 down vote accepted

Viewing deleted objects in Active Directory -

Unless the user has been deleted for longer than the tombstone lifetime of your AD, it will be in there.

Edit: And here's a better article, with pictures! -

share|improve this answer

I also googled around and indeed, do as mentioned on the site

Only, in the search box you choose as filter (&(isDeleted=*)(objectSid=yourobjectSID))

Filter: (&(isDeleted=*)(objectSid=S-1-5-21-1601936709-1892662786-3840804712-315762))

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.