Restore deleted AD User Account in Windows Server 2012

Good day.
I know Windows Server 2012 has an Active Directory Recycle Bin feature, however upon enabling the feature it doesn't display the deleted user account I have deleted prior to enabling the feature. Is this normal? Does the feature only displays deleted AD
objects after you have enabled it? Is there other way to display those objects? Thanks in advance.

Hi James,
Yes, You should have a valid system state back to perform an authoritative restore.
In case you don’t have any system state backup, you can use ADRestore to restore tombstoned objects. When an object is deleted from Active Directory, it isn't actually removed but is instead marked as deleted by an internal marker called
a tombstone.
Note: ADRestore cannot restore the group membership for a user. Meanwhile, not all attribute data can be restored.
http://blogs.technet.com/b/asiasupp/archive/2006/12/14/using-adrestore-tool-to-restore-deleted-objects.aspx
Regards,
Rafic
If you found this post helpful, please give it a "Helpful" vote.
If it answered your question, remember to mark it as an "Answer".
This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!
No he can _not_, as there is no tombstones when the recycle-bin is enabled, recycled objects can not be restored/reanimated.
Enfo Zipper
Christoffer Andersson – Principal Advisor
http://blogs.chrisse.se - Directory Services Blog

Similar Messages

How to unlock user account in Windows Server 2003

Hi,
I want to unlock a user account in Windows Server 2003.
I have read a great post at http://forums.sun.com/thread.jspa?threadID=716240&start=0&tstart=0
But I can not get it to work. According to the post the only thing you need to do is:
"+to unlock an account, just set the value of the attribute lockoutTime to zero+".
When I set lockoutTime to zero nothing happens. The user can still not logon.
When I read the lockoutTime attribute for an account that is locked it is empty or zero if I have tried to unlock it earlier.
So it doesn´t seem to change when the account is locked.
Thanks!

Hi,
Windows Server 2012 has come with the concept of Group Managed Service Account (gMSA).
Following are the benefits of gMSA,
- A single gMSA can be used on multiple hosts.
- A gMSA can be used for scheduled tasks.
- A gMSA can be used for IIS Application Pools, SQL 2012 etc.
Checkout the below link regarding complete information on gMSA (creation and usage),
http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx
Checkout the below thread on similar discussion,
http://social.technet.microsoft.com/Forums/en-US/5bc96d1b-0cec-4d0c-a99d-7f34509c0714/how-to-use-correctly-managed-service-account-in-windows-server-2012-?forum=winserverDS
Regards
Gopi
JiJi Technologies

Configuring group policy for user profiles in Windows Server 2012 R2 Domain

Requesting some experts advise on configuring group policy for user profiles.
We will be building new Windows Server 2012 R2 Domain Controllers (Domain of 400 users).
The settings which I am concerned:
1. Folder Redirection: Desktop, Documents, Favorites.
2. Quota for Folder Redirection - 1 GB per user.
3. Map a networked drive - 1 GB per user.
4. Roaming profile - (Will ignore if it does not suit our requirement).
The question is how outlook profile will be retained / automatically moved if the users move from once computer to other?
FYI, E-mails hosted on MS Office365 and OST file size of few users more than 25GB. So, in case the user moves from one computer to other, the entire mailbox will be downloaded via internet. This consumes high bandwidth if more than 3-4 users shift per day.
Thanks a lot for your valuable time and efforts.

Hi,
>>The question is how outlook profile will be retained / automatically moved if the users move from once computer to other?
This depends on where our outlook data files are stored. If these data files are stored under
drive:\Users\<username>\AppData\Local, then these files can’t be redirected, for folder redirection can’t redirect appdata local or locallow.
However, regarding your question, we can refer to the following thread to find the solution.
Roam outlook profiles without roaming profiles
http://social.technet.microsoft.com/Forums/office/en-US/3908b8e0-8f44-4a34-8eb5-5a024df3463e/roam-outlook-profiles-without-roaming-profiles
In addition, regarding how to configure folder redirection, the following article can be referred to for more information.
Configuring Folder Redirection
http://technet.microsoft.com/library/cc786749.aspx
Hope it helps.
Best regards,
Frank Shen

Set up a smart card for user logon to windows server 2012 R2

Good Evening,
I have Windows Server 2012 R2 Datacenter edition (dreamspark license)
Is it possible to successfully set up smart card logon to a server ? I already have the smart card reader, smart card and the certificate (which is also my digital signature) I know how to setup a DC role (as far as I know, the server has to be in a domain
to use smart card logon) I would like to logon using to my PC using a smart card and set the certificate I already have to use as a certificate for logon.
Kind Regards,
Tomasz

It would take a few things to do this, and could cause some security issues. In short, I assume the certificate you "already have" came from another environment or a commercial provider. You would need to configure your computer to trust that CA
to be an issuer of smart card authentication certificates. That effectively moves a good portion of your computer security control out of your environment. For many environments that is an unacceptable security risk.
If you dont have an Active Directory running, you will also need to make some accommodations to the standard guides. I dont believe there are any published guides on how to do this with a single server and third-party CAs.
Here are some references for generic smart card authentications. They are not 100% applicable to your need, so some interpretation is going to be needed.
http://msdn.microsoft.com/en-us/library/windows/desktop/aa380142(v=vs.85).aspx
http://msdn.microsoft.com/en-us/library/windows/desktop/aa380142(v=vs.85).aspx
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years.

How to allow more than two users on remote desktop on windows server 2012 foundation?

i have a dell server power edge T300 with windows server 2012 foundation. I am unable to connect more than two remote desktop at once.

Hi,
Add to Brain, you cannot have more than 15 user accounts in Windows Server 2012 Foundation.
In order to access a hosted application, such as Microsoft® Office, a license for Windows Server 2012 Remote Desktop Services is required for each user account (not to exceed 15 user
accounts) that directly or indirectly uses RD Gateway to host a graphical user interface, including using Remote Desktop Connection (RDC) client. When using Remote Desktop Services, you may not install or use Remote Desktop Connection Broker or Remote
Desktop Virtualization Host role services. For more information about Remote Desktop CALs , see http://go.microsoft.com/fwlink/?LinkId=140238.
http://technet.microsoft.com/en-us/library/jj679892.aspx
Hope this helps.
Jeremy Wu
TechNet Community Support

How to enble trackpad gestures during a remote dekstop session to windows server 2012

Hello, do you know a trick to enable trackpad gesture as, swype, double touch and so on duringa remote dekstop connection to windows server 2012? because it only recognise the physical mous click,ù and it really annoying.
thank for help

Hi,
Add to Brain, you cannot have more than 15 user accounts in Windows Server 2012 Foundation.
In order to access a hosted application, such as Microsoft® Office, a license for Windows Server 2012 Remote Desktop Services is required for each user account (not to exceed 15 user
accounts) that directly or indirectly uses RD Gateway to host a graphical user interface, including using Remote Desktop Connection (RDC) client. When using Remote Desktop Services, you may not install or use Remote Desktop Connection Broker or Remote
Desktop Virtualization Host role services. For more information about Remote Desktop CALs , see http://go.microsoft.com/fwlink/?LinkId=140238.
http://technet.microsoft.com/en-us/library/jj679892.aspx
Hope this helps.
Jeremy Wu
TechNet Community Support

Windows Server 2012 R2 RDS: RDS Users are unable to delete files from their desktop

Hello,
We are working with Windows Server 2012 R2 RDS. We also implemented User Profile Disks. This is all working fine without problems. The only issue I have is that normal users are unable to delete files from their desktop. They are getting a message:
you'll need administrator permission to delete this file, with the prompt for administrator access.
They can edit, copy, rename, cut and paste files. But they cannot delete a file from their desktop.
I checked the security permissions of the files on the desktop (for example a normal self-created PDF file) and the users are owner and have "Full Control" over the files.
I checked the file permissions and took a look under "Advanced", selecting the specific domain user and checked the "Advanced Permissions" and the user has the "Delete" option checked. So he should be able to delete the
file.
I am guessing this is UPD related issue, or something in GPO. But I already unlinked the GPO objects, that I felt could be the source of this problem, but without results.
Could someone give me a hint on where to look? It's kinda annoying to users, that they can't delete their own files.

Hello Bria,
What you should check first, is the NTFS permissions on the User Profile Disk to begin with. See if the user has full control over the items that are in the UPD.
Also check the GPO's that are enabled for the user and computer account. You can check that by running: gpresult /h <path>\gpresult.html
There are two GPO settings that could prevent the user from deleting his/her own items:
User
Configuration\\Policies\\Administrative Templates\\Windows Components\\Windows Explorer\
Hide these specified drives in My Computer
Prevent access to specified drives in My
Computer
There might be other GPO settings, that block deleting items on the UPD, but can't think of any out of my head.
I can only think NTFS and GPO settings that might prevent the user from deleting items. In my case it was a GPO setting, that I didn't suspect.

Using Windows Server 2012 per-User RDS CAL on Server 2008 R2 Session Host

I have a Remote Desktop Licensing Server setup on my domain controller running Windows Server 2012 R2. I have installed a
’Windows Server 2012 Remote Desktop Services per-User CAL’ there and activated the licensing server already.
Currently I use ONLY Windows Server 2008 R2 machines as RDS Session Hosts (in the future I plan to transition them to 2012 R2, hence the CAL I bought is
already in the newest version).
I have already configured my WS 2008 RDS Session Hosts: set
Per-User licensing mode and specified license server address. The connectivity between my Session Host(s) and my License Server seems to be ok as the
Remote Desktop Session Host Configuration window on the Session Host correctly lists the 2012 per-user
license (CAL installed on server) from the license server.
On the License Server I can also see event logs entries (in
Microsoft-Windows-TerminalServices-Licensing/Admin), indicating that the user has been issued a license.
The issue I am having is that the license being issued is
2008 Per User CAL license (Build-in OverUsed - temporary) and not the 2012 Per User CAL license which is the only license installed on the server. According to the RDS CAL interoperability matrix at
social.technet.microsoft.com/wiki/contents/articles/14988.rds-and-ts-cal-interoperability-matrix.aspx, I was expecting the 2012 license to be backward-compatible with 2008 client (and that
in the absence of legacy licenses, the (only) 2012 license would be used for all clients connecting to the licensing server)
Before I bought my license, I found this document:
download.microsoft.com/download/3/D/4/3D42BDC2-6725-4B29-B75A-A5B04179958B/WindowsServerRDS_VLBrief.pdf
which says that - "newer version RDS CALs can be used with an older version of the server software" (In section FAQ, Q4), which means to me that
the 2012 license would work as-is for the 2008 Server and gives me flexibility when upgrading to the new server version.
How can I make this CAL work in my environment?
Note:
I have already explicitly disabled
Prevent license upgrade Group Policy setting which I assumed would fix the issue but nothing has changed.
Then I have enabled License server security group Group Polity setting
and added computers from my domain to RDS Endpoint Servers AD group. I have also created new AD group called
Terminal Server Computers and added the computer accounts there, but it changes
nothing. Reference - technet.microsoft.com/en-us/library/ee791761.aspx , technet.microsoft.com/en-us/library/cc725704.aspx and blogs.msdn.com/b/rds/archive/2009/09/17/control-the-issuance-of-rds-cals.aspx.
I found one potential ‘workaround’ which involved manually downgrading my CAL license by calling
Microsoft Clearinghouse. I am very reluctant do to so because, as I upgrade parts of my infrastructure to Server 2012, I’d need to then ask Microsoft to manually upgrade a part of my license back as well.
Am I missing something? What should I do to get my 2012 CAL to be issued to 2008 R2 server

Hi, I have tried several other possibilities.
I change expire date for my temporary assigned license (2008 CAL overused). It can be done, by changing Active Directory user properties – msTSExpireDate. When I restart my Session Host server and logged again, my license was renewed
for next 60 days (event ID - 4145).
I also delete information about license for this user (clear msTSExpireDate and msTSLicenseVersion). And the license was successfully removed from License Manager. After another SH restart it gets the same – 2008 overused – license
(event ID 4143 - license server has successfully issued …)
I now, that changing info in AD attributes is a little trick, and this is not a real value - only a reference, but it was useful to delete or change expiration date of license. But it didn’t change type of license as I expected.
Reference -
http://discussions.citrix.com/topic/243320-windows-2008-licensing-questions/
To TP:
I have found your post with information:
If you have a Server 2012 RD Licensing server you may install your 2012 RDS CALs on it (no downgrade necessary) and then set your Server 2008 R2 RDSH to
use the 2012 RDL server. The 2012 RD Licensing server will automatically issue the CALs as 2008. -
https://social.technet.microsoft.com/Forums/windowsserver/en-US/6046ded1-96bf-4d79-89ce-38aac2a6694e/can-we-use-windows-server-2012-rds-cal-license-in-rds-2008-r2-server?forum=winserverTS
And it showing my situation in brief. I also found
similar problems, but the solutions don’t meet my expectations.
https://social.technet.microsoft.com/Forums/windowsserver/en-US/dcfb1966-89a8-4b5d-bf5a-ff03ac0b7a66/rds-cal-licenses-not-recognized?forum=winserverTS
– “sudden all of the CALS were available”
https://social.technet.microsoft.com/Forums/windowsserver/en-US/f1228599-8452-4a3e-a263-061de14bfcfe/server-2012-rds-builtin-overused-cals-issue?forum=winserverTS
– “this should go away after a while”
Is there a way to determine this time you mentioned before? Or should I just wait patiently…

How To Properly Delete a User Profile on Windows 7 in a Domain environment

I have not been able to find an answer that matches the issue I'm facing. I had recently setup a laptop for a user and soon after, he was experiencing issues that I thought might be profile related. So, I did what always worked for me on prior versions of
Windows without any fuss or side affects.
Logged in under the local Administrator account, I went into: System Properties>User Profiles>Settings and removed the user profile from their. When I do that, I get an error message:
Profile Error
Profile not deleted completely. Error - A required privilege is not held by the client
Ok, no problem I think. I just need to delete the user's profile directory under the users folder right? So I do this and figure when I try to log in again as the user that a new profile will be created. However, this is not what happens exactly. I login
with the user credentials and it logs in successfully. However, I get a pop saying:
You have been logged on with a temporary profile
You cannot access your files and files created in this profile will be deleted when you log off. To fix this, log off and try logging on later.
Please see the event log for details or contact your system administrator
So my question is; why did the profile not delete completely after both deleting the user profile under System Properties and after deleting the actual profile directory? What did I miss and what is the proper method of deleting a user profile completely
without running into these other issues?

Hi Womprat,
According to your description, I understand that you want to delete user profile but display an error in Windows 7.
Please use other user (with administrator privileges) login this computer, then open Properties for Computer--->Advanced system setting--->Settings for User Profiles, then select the profile you want to delete.
More details about Delete a user account, please refer to:
http://windows.microsoft.com/en-us/windows7/delete-a-user-account
Additional, please contact Windows 7 IT Pro Team so that you can get more professional suggestions. For your convenience:
https://social.technet.microsoft.com/Forums/en-US/home?category=w7itpro&filter=alltypes&sort=lastpostdesc
Best regards,
Allen Wang

Windows Server 2012 R2 RDS + User profile Disks + App-V = Explorer.exe crashing all of the time

I have built a new RDS farm on Windows Server 2012 R2 with two Session Hosts and a combined Connect Broker/Web Access server. I had the farm up and running with User Profile Disks and all seemed OK. However, as soon as I installed the App-V 5.0 SP2 RDS
client on the session hosts, the explorer.exe process started crashing for any user logging in via the Web Access site. The process crashes and restarts every five to ten seconds. It's the same for administrators. If they log in via Web Access explorer.exe
crashes, but if they RDP directly to one of the session hosts explorer.exe is fine. If I reboot the session hosts, then the first user to log in via Web Access has a stable desktop session (and appears to have a new profile as well). However, if that user
logs out and back in again, explorer.exe starts crashing again. The only applications I have packaged at the moment are Office 2013 and Firefox.
I tried disabling User Profile Disks, but this caused a whole bunch of other problems and I eventually lost the ability to log in at all via Web Access (errors about the user profile service). As this is a small pre-production environment I completed scrapped
all of the servers and rebuilt from scratch. Again, everything appeared fine until I installed the App-V client, then explorer.exe started crashing repeatedly for all users.
Has anyone come across this issue before? I have tried installing the App-V 5.0 SP2 Hotfix Package 2, but this didn't help. I have read in a few forums that App-V doesn't work very well with User Profile Desks, but I have not heard of this particular issue.
Similarly, SP2 seems to have a lot of problems, so I am going to try removing App-V RDp Client SP2 and installing SP1. I ahev also deleted User Profile Disks for the test users to recreate their profiles, but this didn't help either.
Any other suggestions welcome!

I forgot to include the application event log entry for explorer.exe crashing:
Faulting application name: explorer.exe, version: 6.3.9600.17039, time stamp: 0x53156588
Faulting module name: KERNELBASE.dll, version: 6.3.9600.17055, time stamp: 0x532954fb
Exception code: 0xc06d007e
Fault offset: 0x0000000000005bf8
Faulting process id: 0xae8
Faulting application start time: 0x01cfab3a273787fd
Faulting application path: C:\Windows\explorer.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: 69210d77-172d-11e4-80c6-0050560102d1
Faulting package full name:

Can I install iTunes in separate user accounts on Windows Vista 64-bit?

Hi,
My wife and I use different user accounts on Windows Vista 64-bit. Before I go and mess things up on my computer, I wanted ask some questions:
1) Has anyone has successfully installed iTunes to multiple user account?
2) If so, has anyone successfully shared the same music root directory for 2 different iTune instances.
I'm thinking with iTunes very tight integration with the music files (for indexing/searching, etc), that it would be bad to have add/change/delete on the same music root from 2 independent installations.
Experience OR opinions welcome!

) Has anyone has successfully installed iTunes to multiple user account?
You don't install the iTunes application more than once. Each user account in Windows will have its own iTunes library.
If so, has anyone successfully shared the same music root directory for 2 different iTune instances.
Many people have done so. This should help:
iTunes: How to share music between different accounts on a single computer
Note that iTunes has no folder-watching capability, so if you add a track in one user account, the other user will have to add that new item manually, either by using the Add To Library command or dragging the item into the iTunes window. There are a couple of potential solutions from other developers, though:
http://albumbrowser.klarita.net/iTunesFolderWatch.html
http://www.lifehacker.com/software/itunes/hack-attack-automatically-sync-itunes- to-any-folders-175161.php
Thanks to Meg and Hudgie for the tips.

Hide User Accounts on Windows 7 Logon

Hi I Just Installed Windows 7 and Want to hide other user accounts on Windows 7 64 and actually Windows Vista so the only Account showing is mine how do I do This, am I right in thinking it has to be done through the registry;
HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \Windows NT \CurrentVersion \Winlogon, but I do not know how to prceed from this point can some help please

The following will work for a computer in a workgroup (using the welcome page).
For Windows 7 Enterprise (maybe others) you will also need to add a second key below SpecialAccounts called "UserList". Put all the accounts in that subkey.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
I have confirmed this to work on a fresh installation with multiple user accounts and not joined to a domain. I have also confirmed this on my Windows 7 Ultimate computer I use at home. I use the hidden (but not disabled) accounts to provide share access in
a workgroup environment, so I don't want to see them on the logon page. I think the proper workaround for share access is using homegroups instead, but I don't think it provides enough granularity for me.
Ok,
So now that I have done this, I cannot logon to the machine with those accounts anymore or use the admin priviledges for them. I thought it would just hide the accounts. The problem is, I 'hid' all admin accounts, but thought like old versions
of windows that you would be able to CTRL-ALT-DELETE on the login screen to type the username and password, but I can't get it to work!.
How do I login once I have put in users int he UserList key?. I can't get back into the regedit because I don't have any other admin accounts. :(
EDIT: Answer
If you would like to unhide the hidden Administrator account on Windows 7
Operating System , here's how you can do it:
1.Boot Win 7 DVD,go to command prompt and type regedit -it
2.Click on HKLM hive and next navigate File>>Load hive
Navigate to C:\Windows\System32\config folder and choose
SOFTWARE file load it and assign this hive any name for example REM_SOFTWARE
3.Open key:
HKEY_LOCAL_MACHINE\REM_SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
and remove this account or better way remove the whole key:
HKEY_LOCAL_MACHINE\REM_SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts

Just got a mac air and started using it. after getting it set up i migrated files from my old pc. i did not realize that the files migrated to a different user account. how do i delete this user account and not lose the migrated files which i need

I just got a mac air and set it up and started using. after getting famiiar with it i migrated my files from my old pc. i did not realise that the files migrated to a new user account. how do i delete this user account but not lose the migrated files?

Mac 101: File Sharing
Mac OS X 10.7 Help: Transfer files between two Mac computers
Mac OS X 10.7 Help: Set up a Windows computer to share files with Mac users
Mac OS X 10.7 Help: Use iDisk to share files
Mac OS X: Sharing your files with non-Apple computers
How to share a Mac's files with a PC and vice versa.

Is there an application to monitor users who log into Windows Server 2012 R2?

I'm looking at Family Safety Feature in Windows 8 and like what they can do. I have a request to monitor, track users who log into Windows Server 2012 R2 to see how many users login, how long each login is for each user so a monthly report can be generated.
1. I just wonder if Windows Essential 2012 can be used for this purpose or not. If it can, is Windows Essential 2012 a feature can be added or installed on Windows Server 2012 R2?
2. If Window Essential 2012 cannot be used for this purpose, is there any feature in Windows Server 2012 R2 that can be used for this purpose?
3. Is there any other suggestions?
Thank you for your help.
Thanks and Regards,
Hien Phan

Hi Hien,
Anything updates?
It seems that there is no feature can do that. I agree with Tim that you can check the event logs. In general, the event 4624 would be created when a user was logged on, and the event 4634 would be created when a user account was logged
off.
More information:
Tracking User Logon Activity Using Logon Events
Best regards,
Susie
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Restoring Windows Server 2012 w/ADDS and DNS to Hyper-V

So I asked the Below question in the server 2012 general forum but i am sure it is the wrong forum so I though I would ask it here in the hyper-v forum .
So I have one DC in my environment that I would like to upgrade from Windows Server 2012 to Windows Server 2012 r2. I thought before I upgrade the production server I would convert it to a Hyper-V virtual machine and preform the upgrade on a machine that
can be deleted if the upgrade goes horribly wrong. We use Symantec Backup Exec 2014 to backup and restore. So I was able to restore to a virtual machine, the machine powers on, I was unable to open any of the ADDS administration consoles until
I added a Microsoft loop back legacy NIC. To make matters worse when I try to run the in place upgrade from Windows Server 2012 to Windows Server 2012 r2 I receive and error asking me to first run ADPREP /FORESTPREP and /DOMAINPREP. Unfortunately when I run
either one of these commands I receive an error saying that that ADPREP can find the DNS name for the domain or forest. So my question is how do I restore an ADDS server to a virtual machine and bring up all the services so that it functions in the capacity
that the physical machine was functioning but in a closed environment. Thanks for your time and consideration of my inquiry.
Best regards,
Zajac

Hi Zajac,
>>So I have one DC in my environment that I would like to upgrade from Windows Server 2012 to Windows Server 2012 r2. I thought before I upgrade the production server I would convert it to a Hyper-V virtual machine and preform the upgrade on a machine
that can be deleted if the upgrade goes horribly wrong.
If I understand it correctly , you are going to P2V that DC for upgrade test .
I would suggest you to use Disk2VHD to achieve P2V for your DC then test in-place upgrade .
http://technet.microsoft.com/en-us/sysinternals/ee656415.aspx
Best Regards
Elton Ji
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Restore deleted AD User Account in Windows Server 2012

Similar Messages

Maybe you are looking for