Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I find last logon information in Active Directory of a user that has been deleted?

share|improve this question

migrated from security.stackexchange.com Aug 20 '13 at 15:36

This question came from our site for Information security professionals.

This belongs to serverfault. Even then, you will need to specify the version of AD that you're using (i.e. unless you're using 2008R2 and have enabled the AD recycle bin, it might not be possible to obtain that information) –  Stephane Aug 20 '13 at 13:26

1 Answer 1

In case of AD 2003, once you delete the user object, most of the properties get removed from the user object and its SID information is stored in Deleted Items folder. There if you undelete this user, you will get object restored but rest properties you will need to set manually. Another option is you can restore your system state, mark the delete user as authoritative and restore complete user object to know more information about this user object. Once you get the information, again you can delete this user.

At this moment, In your case, I see only one option as restore same user object from backups and find this information.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.