Skip to main content
AD Academy
Back to all events
4726Security (DC)AccountsWARNLast updated:

User account deleted

What it means

A user was deleted. Deletion is usually a mistake — disable instead. Recovery needs the AD Recycle Bin enabled beforehand.

First steps

  1. 1Check the AD Recycle Bin: Get-ADOptionalFeature -Filter *
  2. 2Restore: Get-ADObject -Filter 'Deleted -eq $true' -IncludeDeletedObjects | Restore-ADObject

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.