Using the Active Directory Recycle Bin I will demonstrate the consequences of deleting and restoring an Domain Administrator user account and display which properties are affected or changed.
First off we create a new user which we then add to the Domain Admins group with the following PowerShell commands:
New-ADUser -Name Admin_Jaap -SamAccountName Admin_Jaap -Enabled:$true ` -AccountPassword (ConvertTo-SecureString -AsPlainText 'Secret01' -Force) Add-ADGroupMember -Identity 'Domain Admins' -Members Admin_Jaap |
Then we capture output of Get-ADObject with all properties in a variable:
$BeforeDel = Get-ADObject -LDAPFilter "(samaccountname=Admin_Jaap)" -Properties * |
The next step is to delete the user using Remove-ADUser:
Remove-ADUser -Identity Admin_Jaap -Confirm:$false |
Now the account can be restored:
Restore-ADObject -Identity $BeforeDel.ObjectGUID -Confirm:$false |
Now that the object has been restored, the password that we originally set has been recovered as well. This can be verified by running the following PowerShell command:
Invoke-Command -ScriptBlock {whoami} -Credential admin_jaap -ComputerName dc1 |
We capture the information stored in AD to the $AfterRes variable:
$AfterRes = Get-ADObject -LDAPFilter "(samaccountname=Admin_Jaap)" -Properties * |
Now that we have captured both the account information when the account was just created and after the account was restored we can use this information to have a look at which attributes if any have changed. To make this comparison the Compare-Object Cmdlet can be used. To be able to compare these AD Object, the variable is first piped into Out-String and then split up into an array of strings.
Compare-Object -ReferenceObject (($BeforeDel|Out-String) -split '\n') ` -DifferenceObject (($AfterRes|Out-String) -split '\n') -IncludeEqual |
The results show that most attributes are completely unchanged. Attributes containing information related to either replication, or when the object was last changed will be the only changed objects.
