Recycle Bin status should be retrievable
AD-FOR-04InfoActive DirectoryDirectory configuration
Part of Active Directory · Active Directory · Directory configuration · All checks
Invoke-Maester -TestId AD-FOR-04Overview
Section titled “Overview”The Active Directory Recycle Bin provides significant advantages over traditional tombstone reanimation:
- Complete Object Recovery: Restores all object attributes, group memberships, and links
- Simplified Recovery: No need to restore from backup for accidental deletions
- Reduced Downtime: Faster recovery of critical objects
- Attribute Preservation: Unlike tombstone reanimation, all attributes are preserved
Requirements:
- Forest functional level of Windows Server 2008 R2 or higher
- Must be explicitly enabled (not enabled by default)
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”Enable the Recycle Bin if your forest functional level supports it:
Enable-ADOptionalFeature -Identity "Recycle Bin Feature" -Scope ForestOrConfigurationSet -Target "yourforest.com"Important Considerations:
- Irreversible: Once enabled, the Recycle Bin cannot be disabled
- Database Size: Increases AD database size due to preserved objects
- Tombstone Lifetime: Objects are retained for the tombstone lifetime period
- Planning: Ensure adequate disk space and backup strategies
How the Test Works
Section titled “How the Test Works”This test checks the optional features in Active Directory to determine if the Recycle Bin Feature is enabled and reports its status.
Related Tests
Section titled “Related Tests”Test-MtAdTombstoneLifetime- Retrieves the tombstone lifetime (affects Recycle Bin retention)Test-MtAdForestFunctionalLevel- Retrieves the forest functional level (required for Recycle Bin)
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-FOR-04 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Directory configuration |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdRecycleBinStatus |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty, ActiveDirectory:Ldap:msDS-OptionalFeature:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain/Test.AD-FOR-04.ps1 - Documentation:
tests/ad/domain/Test.AD-FOR-04.md