This question was recently asked in the Microsoft Technet Directory Services forum.
The answer is no.
We must distingush between two cases:
- Restoring the properties (attributes) of a deleted object, with the object itself, upon recovery.
- Reverting changes to properties of an undeleted object to a previous state.
The Active Directory Recycle Bin does not have the ability to track simple changes to objects.
If the object itself is not deleted, no element is moved to the Recycle Bin for possible recovery in the future.
In other words, there is no rollback capacity for changes to object properties, or, in other words, to the values of these properties.
I would like to illustrate this distinction with the examples below.
First, I will delete a group object - "Group1" - in Active Directory Users and Computers. Note that Group1 has three members: Valerie, Vik and Yvette.
So I delete the group...
Suddenly, I realize that this was not the group I was supposed to delete. Or Management informs me that there was a mistake: in fact, they really wanted me to delete Group2.
We have at least two options, provided that...
- We schedule regular backups.
- We have enabled the Active Directory Recycle Bin (yes, it must be enabled first, and some conditions must be met. Essentially, we must be at what is called the "Windows 2008 R2 Forest Functional Level").
I open the container and...
There is Group1! Just waiting to be restored! I right-click on the item, select "Restore" and we should be "all set".
But that's not all. Group objects will be recovered with their members:
Now I will delete not the group itself but remove one of its members: Valerie Owen.
Will I be able to see this member in the Recycle Bin and restore it?
There is nothing to restore because we did not delete the user object representing Valerie Owen. Instead, we removed one of the values of the Group1 membership property that designated this user as a member.
At this point, I am quite confident that my assertions above (the first lines of this post) are correct,
But let's perform the same experiment with some user object properties.
Here, among others, we can see the "Description" and the "Office" properties of the Alison Lindsay user object.
I will modify the values of these attributes (synonomous with properties here) as follows:
Does the Recycle Bin track these changes? Can I perform a rollback to the previous values?