Recycle Bin for Active Directory

Cygna Auditor enables you to restore Active Directory objects such as deleted AD users or groups. Empowered with this feature, you can not only detect security issues but also fix them in a fraction of a second.

If you are looking for a way to roll back changes, see Rollback for Active Directory.

To add events to rollback queue:

  1. Navigate to Auditor / Tools / Active Directory / Recycle Bin, select a domain.
  2. Review deleted objects. By default, Cygna Auditor lists objects for the last 7 days. Update this value if necessary.
  3. Select the entry you want to recover.
  4. On the Recovery Target step, review changes, old and new values, etc.
  5. On the Snapshot Selection step, pick a snapshot. Cygna Auditor will restore the object to the state it was at the moment of the snapshot creation. You can use the most recent snapshot or a snapshot taken on a certain date.
  6. Review Summary and click Recover. You can recover the object as the currently logged-in user or impersonate an administrator. In this case, you'll be prompted to provide administrative credentials.

 

Bulk Recovery and Rollback of Active Directory Objects

This section describes how to perform bulk (unlimited) recovery and rollback of Active Directory objects using the DbTool command-line utility. This workflow is designed for large-scale correction scenarios where many objects must be restored or reverted efficiently and repeatably.

The process is file-driven: you build a flat text file containing the distinguishedName (DN) values of objects to process, then pass that file to the bulk operation.

Overview: Recovery vs. Rollback

  • Recovery restores objects that were deleted from Active Directory by reanimating them from the Recycle Bin.
  • Rollback reverts one or more attributes on existing objects to their values at a previous point in time, effectively undoing an unwanted or incorrect change.

Bulk rollback is commonly used to reverse large-scale or accidental changes, such as mass group membership updates, attribute misconfiguration, or automation errors.

Important Notes: Distinguished Names and Mixed Files

  • The input file must contain one distinguishedName per line.
  • For deleted objects, the file must contain the current recycle bin distinguishedName, not the object’s original distinguishedName prior to deletion.
  • For rollback, the distinguishedName refers to the object’s active distinguishedName.
  • A single input file may contain a mix of deleted and existing objects:
    • If an object already exists, recovery is skipped for that object.
    • Existing objects are processed as a rollback (reverting the selected attributes to historical values).
    • Deleted objects are processed as a recovery using the recycle bin distinguishedName.

Step 1: Search the Active Directory Recycle Bin

Use SearchRecycleBin to identify deleted objects and optionally write their distinguishedName values to a file for later use. This is the recommended method for generating recovery files because it outputs the correct current recycle bin distinguishedName values.

Command syntax 

DbTool SearchRecycleBin [options]

Options

Option Description
--classes Limit the returned objects to the specified objectClass values (for example, user, group).
--contains Only return objects where the distinguishedName contains the specified text.
--parent Only return objects where the lastKnownParent distinguishedName matches.
--limit Limit the maximum number of returned objects.
--before Return objects deleted before the specified date/time.
--file Output all matching distinguishedName values to the specified file. Deleted objects are written using the current recycle bin distinguishedName. The output file can be used as input for a bulk rollback/recovery action.
--dc Domain controller to use for the operation.
-v, --verbose Verbose output.

Example: generate a recovery file for deleted users 

DbTool SearchRecycleBin ^
				--classes user ^
				--before 2026-01-01 ^
		--file deleted-users.txt

This command searches the recycle bin for deleted user objects removed before January 1, 2026, and writes their current distinguishedName values to deleted-users.txt.

Step 2: Perform a Bulk Rollback or Recovery

Once you have a file containing distinguishedName values, use BulkRollback to process the list. There is no enforced limit on the number of objects included.

Command syntax 

DbTool BulkRollback [options]

Options

Option Description
--classes Limit the operation to specific objectClass values.
--contains Further filter objects based on distinguishedName content.
--parent Limit the operation to objects with a specific lastKnownParent.
--limit Limit the maximum number of objects processed.
--before Process only objects deleted before the specified date/time.
--file Input file containing distinguishedName values to be recovered or rolled back.
--dc Domain controller to use for the operation.
-v, --verbose Verbose output.

Example: bulk rollback/recovery using a file 

DbTool BulkRollback ^
				--file deleted-users.txt ^
		--dc DC01.corp.example.com

Rollback Usage Notes

Rollback is typically used to undo a mass change by selecting the target objects and the attribute(s) to revert, then specifying a date/time when the values were known to be correct. The tool applies historical values for the selected attributes across all listed objects.

Pre-flight Validation and Confirmation

Before making any changes, the bulk operation performs a pre-flight check and outputs details of the planned actions. This includes:

  • Resolving each distinguishedName
  • Determining whether each object will be recovered or rolled back
  • Identifying the attributes and historical values that will be applied (for rollback)

The tool then prompts for confirmation. No changes are applied until the user explicitly confirms the operation.

Best Practices

  • Review the generated DN file before running a bulk operation to ensure it contains only the intended objects.
  • Start with a small test file to validate expected behavior before performing large-scale recovery or rollback.
  • Use --verbose during validation or troubleshooting to observe per-object processing details.
  • Store recovery/rollback files securely, as they may contain sensitive directory structure information.

Summary

Bulk recovery and bulk rollback provide scalable, file-driven mechanisms for correcting large-scale Active Directory issues:

  • Recovery restores deleted objects using their recycle bin distinguishedName values.
  • Rollback reverses attribute-level changes on existing objects, allowing administrators to undo mass updates and return objects to a known-good state.

By separating object selection from execution, these workflows support validation, auditing, and controlled change management while avoiding practical limits on the number of objects processed.