Remove-ADUser permanently deletes - skips recycle bin

Question

Remove-ADUser permanently deletes - skips recycle bin

Dane Briggs 156

We are going through a project to cleanup AD. We have AD Recycle Bin enabled. We are using a script to delete the users. We had a user that needed to be recovered. When I went to the Recycle Bin I noticed that none of the users that we deleted are in the Deleted Object container. Upon further testing I see deleted users in the Deleted Objects container if they were deleted using ADUC but not if deleted using powershell. Any ideas why Remove-ADUser is skipping the Recycle Bin and how to stop it from skipping?

Remove-ADUser -Server DC1 $id -Confirm:$false -Verbose -ErrorAction Stop

Upon further investigation, the Systems Admin that is running the script is using an account from a trusted domain.

We have a management domain that manages multiple domains with one way trusts.

Answer 1

Thameur-BOURBITA 15,811

Hi @Dane Briggs

You can use the following command to check if the user is deleted and moved to recycle bin:

Get-ADObject -filter 'isdeleted -eq $true -and samaccountName name -ne "SamaccountName"' -includeDeletedObjects -property *

For you information , when the account is deleted and moved to recycle bin temporary and if the account is not restored , it will be deleted definitely.

![thumbnail image 1 of blog post titled

						The AD Recycle Bin: Understanding, Implementing, Best Practices, and Troubleshooting

](/api/attachments/9c12c7aa-612a-4128-8179-6111226814d7?platform=QnA)

Please don't forget to mark helpful answer as accepted

Dane Briggs 156 Reputation points

2023-03-17T18:05:48.12+00:00

The deleted users are not in the Recycle Bin. I've checked using the Active Directory Administrative Center and by using the Get-ADObject command.

I believe the issue is that since the Sys Admin who is running the script is using an account from a Trusted Domain and probably does not have access to the Recycle Bin so it is bypassing the recycle bin.
Thameur-BOURBITA 15,811 Reputation points

2023-03-17T23:45:34.4+00:00
Hi @Dane Briggs •

You are right. I checked it in my test envirement and I got same behavor.

In this case you have two options :

Create a service account for each domain and avoid use of service acount from trusted domain

Try to give permission to service account on recycle bin folder ( I don't recommend it) :How to let non-administrators view the Active Directory deleted objects container

Please don't forfet to mark ehlpful answer as accepted

Remove-ADUser permanently deletes - skips recycle bin

0 additional answers

Activity