Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a need to find a username that was deleted from the AD using only the SID. I understand that Windows AD leaves being a Tombstone file that might contain this information. Can someone give me the syntax of a command or post a document that might point me in the right direction?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Viewing deleted objects in Active Directory - http://support.microsoft.com/kb/258310

Unless the user has been deleted for longer than the tombstone lifetime of your AD, it will be in there.

Edit: And here's a better article, with pictures! - http://www.petri.co.il/deleted-objects-in-active-directory.htm

share|improve this answer

I also googled around and indeed, do as mentioned on the site http://www.petri.co.il/deleted-objects-in-active-directory.htm.

Only, in the search box you choose as filter (&(isDeleted=*)(objectSid=yourobjectSID))

Example:
Filter: (&(isDeleted=*)(objectSid=S-1-5-21-1601936709-1892662786-3840804712-315762))

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.