Deleted object queries use the LDAP tombstone control to inspect removed AD objects that still exist in the Deleted Objects container. This is useful for finding old users, old service accounts, previous names, and last-known parent locations.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
LDAP tombstone search:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" -s sub -E '1.2.840.113556.1.4.417' '(isDeleted=TRUE)' cn sAMAccountName objectClass distinguishedName whenDeleted msDS-LastKnownParent lastKnownParent
Target deleted users:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" -s sub -E '1.2.840.113556.1.4.417' '(&(isDeleted=TRUE)(objectClass=user))' cn sAMAccountName distinguishedName whenDeleted msDS-LastKnownParent
PowerShell DirectorySearcher:
$root = New-Object System.DirectoryServices.DirectoryEntry('LDAP://DC=ootw,DC=local')
$searcher = New-Object System.DirectoryServices.DirectorySearcher($root)
$searcher.Filter = '(isDeleted=TRUE)'
$searcher.SearchScope = 'Subtree'
$searcher.Tombstone = $true
$searcher.FindAll() | ForEach-Object { $_.Properties.distinguishedname }
AD module:
Get-ADObject -LDAPFilter '(isDeleted=TRUE)' -IncludeDeletedObjects -Properties lastKnownParent,whenDeleted,sAMAccountName |
Select-Object Name,ObjectClass,DistinguishedName,lastKnownParent,whenDeleted,sAMAccountName