Date for Deleted AD Objects

[Guest]

Is there a way to see when an AD object was deleted?

[cmccullough]

Re: Date for Deleted AD Objects

I don't believe so, unless you can find and entry in the event logs of your domain controllers.

[Guest]

Re: Date for Deleted AD Objects

That might be a nice enhancement to the "View Deleted Objects" feature. The date and who deleted the object.

[kstanush]

Re: Date for Deleted AD Objects

Actually, the deleted date is not in AD, so there isn't anything we can add. But Windows 2008 added more functionality to this area so I don't know if the deleted date is there.

Which operating system is your domain up to, ie the functional level ?

[Guest]

Re: Date for Deleted AD Objects

Windows Server 2003

[kstanush]

Re: Date for Deleted AD Objects

Windows 2003's undelete feature is very weak, but its been enhanced a lot in Windows 2008. I'll check to see if 2008 tracks the deleted date.

[kstanush]

Re: Date for Deleted AD Objects

I have not found a way to access the directory attributes that may or may not exist for a deleted object. Chances are Microsoft does not create any attributes, meaning that you won't see a 'whodeleted' attribute or 'datedeleted'.

However, I did see that the 'whenchanged' attribute is updated to reflect the deletion date and time. When restored, the 'whenchanged' is updated again.

I've added the whenchanged attribute to the end of the attribute list when viewing deleted objects. This change will be in the first patch for v8.0. There are a number of small issues found in v8.0 (nothing critical) so we will probably release this patch in a few weeks.

Thanks for asking about this.

[Guest]

Re: Date for Deleted AD Objects

Thanks, that would be great. Love your product!