7.1What a restore is

When an object is deleted from Active Directory it is not erased at once. Active Directory moves it into the domain's hidden Deleted Objects container, renames it internally and keeps it there for a fixed period, the deleted object lifetime. While it is there it can be restored. Once that period has passed, Active Directory recycles the object and it can no longer be brought back by any tool.

A restore is not the same as creating a new object with the same name. A restored object keeps its original objectGUID and security identifier (SID). Everything in your environment that refers to the object by its identity starts working again: permissions on file shares and other resources, group grants, delegated rights and user profiles. A replacement object created by hand would have a new SID, and every one of those grants would have to be rebuilt.

Important: Because a restored object keeps its identity, restoring a deleted account restores whatever that account could do. The console treats the restore of an administrative account as a separate decision with its own permission. See Restoring privileged objects in Restoring an object.

With and without the Active Directory Recycle Bin feature

How much of the object comes back depends on whether the Active Directory Recycle Bin optional feature is enabled in the forest.

When the feature is not enabled, Active Directory keeps only a minimal tombstone of each deleted object. You can still restore it, but it comes back with almost nothing except its identity, and somebody has to rebuild it. SYNERGY Management Gateway helps here: if the deletion was carried out through the platform, it kept an encrypted copy of the object's attributes, and you can write them back after the restore. See Putting attributes back after a stripped restore.

Note: Enabling the Active Directory Recycle Bin is done in Active Directory itself (for example with the Enable-ADOptionalFeature cmdlet or the Active Directory Administrative Center), not in SYNERGY Management Gateway. It cannot be switched off again once enabled, and it only protects objects deleted after it was turned on. The console checks the feature's state periodically, so after you enable it the screen may take up to about 15 minutes to report it as on.