7.5The restore image kept by the platform

Whenever SYNERGY Management Gateway deletes a directory object, from the Directory Browser, the REST API, an AI agent or an n8n workflow, it first takes a copy of the object's attributes, the restore image, and stores it encrypted in the platform's database. The image exists for one purpose: to put the attributes back if the object is restored while the Active Directory Recycle Bin feature is off.

Points to be aware of:

• Only deletions made through the platform have an image. An object deleted in another tool, such as Active Directory Users and Computers or PowerShell, has no image, and its attributes cannot be put back from here.
• Images expire. By default an image is kept for 180 days, matching Active Directory's default deleted object lifetime, because after that the object cannot be restored anyway. Expired images are removed by a daily clean-up.
• Images can be incomplete. Very large attribute values may be left out when the image is taken. The reapply dialog says when this happened.
• Some attributes are never written back. Constructed and system-only attributes cannot be written; attributes that decide access or delegation need the privileged-restore permission; and group memberships are recorded but not written (see below).

Two configuration settings in the platform's appsettings file control the images:

Note: A restore image is a complete copy of a directory object. If your organisation does not want the platform to hold such copies, set RestoreImages:Enabled to false and rely on the Active Directory Recycle Bin feature instead.