LDAP Deleted Objects Query

Query for deleted objects

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: ldapsearch
Category: Post-Exploitation / AD Object Manipulation
Platform: linux
Requires: password
Protocols: LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

ldapsearch -H ldap://<ip> -D '<user>@<domain>' -w '<password>' -b 'CN=Deleted Objects,DC=voleur,DC=htb' -s sub '(isDeleted=TRUE)' -E '!1.2.840.113556.1.4.417' dn cn distinguishedName lastKnownParent whenChanged isDeleted

Examples

ldapsearch -H ldap://10.10.11.76 -D 'svc_ldap@voleur.htb' -w 'M1XyC9pW7qT5Vn' -b 'CN=Deleted Objects,DC=voleur,DC=htb' -s sub '(isDeleted=TRUE)' -E '!1.2.840.113556.1.4.417' dn cn distinguishedName lastKnownParent whenChanged isDeleted

Tags

ldapsearch ldap deleted objects

bloodyAD add dnsRecord Create a new AD-integrated DNS record. Authenticated users can create records by default…
bloodyAD Add GenericAll Grant attacker GenericAll over a target object via LDAP. Requires WriteDacl or Owner on…
bloodyAD Add Group Member Add a user/computer to a group via LDAP. Common abuse path when GenericAll/WriteProperty…
bloodyAD Create User Create a new domain user object. Requires Create Child rights on a Users container…
bloodyAD remove object Delete an arbitrary AD object you have rights on. Cleanup step for accounts/computers…
bloodyAD set restore Restore a tombstoned object from the AD recycle bin. Useful for resurrecting accounts…
Impacket addcomputer.py Add a machine account to the domain using the default MachineAccountQuota (10).…
Impacket Net Enumerate AD users, groups, and shares via Net commands over SMB