US English (US)
GB English (UK)

Contact Us

If you still have questions or prefer to get help directly from an agent, please submit a request.
We’ll get back to you as soon as possible.

Please fill out the contact form below and we will reply as soon as possible.

  • Create ticket
English (US)
US English (US)
GB English (UK)
  • Home
  • Directory Synchronisation

Enable rights over the AD Recycle Bin

Gain insight on how to control user's access to the Active Directory Recycle Bin and enable corresponding user rights.

Written by Conrad Murray

Updated at May 22nd, 2025

Contact Us

If you still have questions or prefer to get help directly from an agent, please submit a request.
We’ll get back to you as soon as possible.

Please fill out the contact form below and we will reply as soon as possible.

  • Getting Started
  • FAQs
  • API Documentation
  • Integrations
  • Migration Agent
  • Directory Synchronisation
  • Remote DC agent
  • Remote Password Sync Agent
  • Install and Configure
  • Support
  • Complex Expressions
+ More

Table of Contents

Enable rights over the AD Recycle Bin

PowerSyncPro has the ability to restore deleted objects from the target AD Recycle Bin if they were ever created or matched by PowerSyncPro.  They might have been deleted manually in the target by accident, or got marked out of scope in the source through a config change, or the objects themselves were moved to an out of scope OU, or had an attribute changed that was being used for scoping.

For PowerSyncPro to be able to re-animate objects from the AD Recycle Bin, it needs the appropriate permissions configured.

 

Enable rights over the AD Recycle Bin

Step 1 - Enable the AD Recycle Bin for your Forest if it is not already enabled.

PowerShell:

Enable-ADOptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target [your forest]

Active Directory Administrative Center\Tasks

Step 2 - Create a Global Security Group e.g. "Restore_Objects"

Step 3 - Add the PSP Service Account to this Group

Step 4 - At an elevated command prompt, with a Domain Admin account, run the following commands.

(Replace “Restore_Objects” with the group name you created and replace "dc=yourdomain,dc=local" with your actual Active Directory Domain)

dsacls "dc=yourdomain,dc=local" /g "Restore_Objects:ca;Reanimate Tombstones"
dsacls "CN=Deleted Objects,dc=yourdomain,dc=local" /takeownership
dsacls "CN=Deleted Objects,dc=yourdomain,dc=local" /g "Restore_Objects:LCRP"
dsacls "dc=yourdomain,dc=local" /I:T /g "Restore_Objects:WPCC" 
recycle bin restore deleted objects reanimate tombstones active directory deleted objects

Was this article helpful?

Yes
No
Give feedback about this article

Related Articles

  • Sync profile has a * (asterisk) next to it
  • SMTP entries do not flow
  • legacyExchangeDN and other mail attributes - implicit writes
  • No License for Domain
  • Best practice for using userAccountControl in scoping

Subscribe to Newsletter

Drop your email in the box below to sign up. We promise to keep our updates relevant and useful – and we’ll never share your details.

PowerSyncPro is the ultimate product for easing the pain and frustration during mergers, acquisitions, divestitures, and consolidations.

Terms & Conditions

  • FAQs
  • Privacy Policy
  • Cookies
  • Anti Slavery Notice

PowerSyncPro

  • Case Studies
  • Contact sales
  • Meet the Team
  • EULA

Get Connected

Room 73, Wrest House, Wrest Park, Silsoe, Bedford, England, MK45 4HR
info@powersyncpro.com

Twitter Youtube Linkedin

Knowledge Base Software powered by Helpjuice

Expand