PowerShell Restore Deleted User

Restore Deleted User Object

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

Get-ADObject

Category

Post-Exploitation / AD Object Manipulation

Platform

linux

Requires

shell access

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

Get-ADObject -Filter 'samaccountname -eq "<user>"' -IncludeDeletedObjects | Restore-ADObject

Examples

Get-ADObject -Filter 'samaccountname -eq "Todd.Wolfe"' -IncludeDeletedObjects | Restore-ADObject

Tags

powershell ad restore user deleted

Related commands

• bloodyAD add dnsRecord Create a new AD-integrated DNS record. Authenticated users can create records by default…
• bloodyAD Add GenericAll Grant attacker GenericAll over a target object via LDAP. Requires WriteDacl or Owner on…
• bloodyAD Add Group Member Add a user/computer to a group via LDAP. Common abuse path when GenericAll/WriteProperty…
• bloodyAD Create User Create a new domain user object. Requires Create Child rights on a Users container…
• bloodyAD remove object Delete an arbitrary AD object you have rights on. Cleanup step for accounts/computers…
• bloodyAD set restore Restore a tombstoned object from the AD recycle bin. Useful for resurrecting accounts…
• Impacket addcomputer.py Add a machine account to the domain using the default MachineAccountQuota (10).…
• Impacket Net Enumerate AD users, groups, and shares via Net commands over SMB