Accidentally deleted Active Directory-Based Activation (ADBA) object: New machines cannot activate!

Lin Dan 20 Reputation points
2026-07-24T03:01:29.07+00:00

Hi guys,

Big problem at site today, need some advice from Active Directory / Windows Server sifu-sifu here.

INCIDENT

Someone accidentally deleted the Active Directory-Based Activation (ADBA) object inside the AD forest (under CN=Activation Objects,CN=Microsoft KMS,CN=Services,CN=Configuration). Now all newly joined / freshly deployed machines cannot activate via ADBA at all. Existing activated machines still okay for now, but new rollouts all stuck.

EMERGENCY RECOVERY & TECHNICAL QUESTION

We don't want to do full Authoritative Restore of the Configuration Partition if we can avoid it (too risky for the rest of AD).

  1. If we re-run Volume Activation Services wizard on a member server and re-enter our CSVLK (KMS Host Key), will it safely recreate the missing ADBA object in AD without messing up or resetting the activation status of previously activated endpoints?
  2. Is there any tombstone / AD Recycle Bin recovery trick specifically for ADBA objects, or slmgr.vbs CLI method to push the key directly back into the AD partition?

Quite gabra now because new machine deployment is blocked. Anyone hit this before? Appreciate any help, thanks!

LD.

Windows for business | Windows 365 Enterprise
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marcin Policht 101K Reputation points MVP Volunteer Moderator
    2026-07-24T03:22:25.35+00:00

    Rerunning the Volume Activation Tools (or the Volume Activation Services wizard) with the same CSVLK should republish the ADBA activation object. Republishing the object should not reset or invalidate existing client activations. Activation state is maintained on the client.

    There is no supported slmgr.vbs command that writes the ADBA object into Active Directory - the tool only manages the local licensing configuration.

    Active Directory Recycle Bin does not restore deleted objects from the Configuration naming context. Its recovery scope is the domain naming context.

    If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    hth

    Marcin

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.