Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter IV - Active Directory / 02. Protocols / LDAP / Enumeration

Deleted Objects

Deleted object queries use the LDAP tombstone control to inspect removed AD objects that still exist in the Deleted Objects container. This is useful for finding old users, old service accounts, previous names, and last-known parent locations.

export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'

LDAP tombstone search:

ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" -s sub -E '1.2.840.113556.1.4.417' '(isDeleted=TRUE)' cn sAMAccountName objectClass distinguishedName whenDeleted msDS-LastKnownParent lastKnownParent

Target deleted users:

ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" -s sub -E '1.2.840.113556.1.4.417' '(&(isDeleted=TRUE)(objectClass=user))' cn sAMAccountName distinguishedName whenDeleted msDS-LastKnownParent

PowerShell DirectorySearcher:

$root = New-Object System.DirectoryServices.DirectoryEntry('LDAP://DC=ootw,DC=local')
$searcher = New-Object System.DirectoryServices.DirectorySearcher($root)
$searcher.Filter = '(isDeleted=TRUE)'
$searcher.SearchScope = 'Subtree'
$searcher.Tombstone = $true
$searcher.FindAll() | ForEach-Object { $_.Properties.distinguishedname }

AD module:

Get-ADObject -LDAPFilter '(isDeleted=TRUE)' -IncludeDeletedObjects -Properties lastKnownParent,whenDeleted,sAMAccountName |
    Select-Object Name,ObjectClass,DistinguishedName,lastKnownParent,whenDeleted,sAMAccountName