PowerShell Get Deleted AD Objects

Get deleted Active Directory objects

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: Get-ADObject
Category: Post-Exploitation / AD Object Manipulation
Platform: windows
Requires: shell access

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects

Examples

Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects

Tags

powershell ad deleted objects

bloodyAD add dnsRecord Create a new AD-integrated DNS record. Authenticated users can create records by default…
bloodyAD Add GenericAll Grant attacker GenericAll over a target object via LDAP. Requires WriteDacl or Owner on…
bloodyAD Add Group Member Add a user/computer to a group via LDAP. Common abuse path when GenericAll/WriteProperty…
bloodyAD Create User Create a new domain user object. Requires Create Child rights on a Users container…
bloodyAD remove object Delete an arbitrary AD object you have rights on. Cleanup step for accounts/computers…
bloodyAD set restore Restore a tombstoned object from the AD recycle bin. Useful for resurrecting accounts…
Impacket addcomputer.py Add a machine account to the domain using the default MachineAccountQuota (10).…
Impacket Net Enumerate AD users, groups, and shares via Net commands over SMB