The Goodness that is Repadmin.exe

re: The Goodness that is Repadmin.exe

Yann — Sun, 18 Jun 2006 22:03:11 GMT

Just a little mistake in my repadmin command above. So just correct with the right user that is "yann" and not "dac"; the latter one was the user i had investigated last year in my AD environnement.
repadmin /showobjmeta DC1 "CN=yann\0ADEL:2a299250-27ea-4a05-bdf7-5ca9558ff733,CN=Deleted Objects,DC=mydomain,DC=fr" | find /i "isdeleted".
Regards,

re: The Goodness that is Repadmin.exe

Yann — Sun, 18 Jun 2006 21:16:22 GMT

Hello Tim,

Thanks for clarification.
Endeed, when an object is deleted, in our case a user yann ;), the DN's changed to this one for example;
CN=yann\0ADEL:2a299250-27ea-4a05-bdf7-5ca9558ff733,CN=Deleted Objects,DC=mydomain,DC=fr.
Adrestore permits me to find this DN. And when we put all together with repadmin, the command looks like:
repadmin /showobjmeta DC1 "CN=dac\0ADEL:2a299250-27ea-4a05-bdf7-5ca9558ff733,CN=Deleted Objects,DC=mydomain,DC=fr" | find /i "isdeleted". The results of this is:
17730966 SITE1\DC2 17730966 2005-10-27 10:37:11 1 isDeleted.
So u can find where and when a user was deleted. That works for me.
Why using the deleted object DN instead of guid ?
Because I remembered I was not able to work with the guid of the object , so i tried with the DN of the deleted object and that works fine.

Regards,

Yann

re: The Goodness that is Repadmin.exe

Tim Springston [MS] — Sun, 18 Jun 2006 20:14:14 GMT

Thanks for the post! The above will work very well, but you may hit one snag. When an object is marked for deletion the distinguishename changes since it is then in the "container" for Deleted Items. So the repadmin command may struggle with that...

But, your comment reminded me about being able to insert the objectGUID of te object in and track it that way.

So, get the objectGUID of the object that was deleted and try using that. Just substitute the DN string entry for the syntax with this:

"<GUID=guidnumber>"

You can get the objectGUID by using LDP.EXE to view it, or by dumping the database using LDP.EXE.

Let me know if I misunderstood something from your comment. Thanks again for reading!

Tim

re: The Goodness that is Repadmin.exe

Yann — Sat, 17 Jun 2006 14:39:42 GMT

Hi Ian,

To figure out where a user was deleted (and how to reanimate it assuming u are in AD w2k3 *only*),you need 2 (free) tools:
-> Adrestore, where u can donwload here http://www.sysinternals.com/Utilities/AdRestore.html
-> repadmin /showobjmeta dcname deletedobjectDN | find /i "isdeleted"
-> and obviously, auditing already activated on your Default Domain Controler Policy :).
Here we go !
Suppose that yann was deleted:
1) in a command shell, enter adrestore yann. Adrestore will query the tombstone to list all users deleted objects that contains "yann" in their CN.
Adrestore will also output the DN of the deleted user yann. Focus on the right yann.

2)Enter the second command with repadmin and just replace deletedobjectDN by the one u found
with adrestore, and also replace dcname with the name of one of your domain controllers. Make sure u put the strings corresponding to deletedobjectDN in quotations if there are any spaces in it. Reapdmin will show u where(on which DC) and when(time/date) yann was deleted thanks to the "isdeleted" attribute that was piping.

Next, go to your DC, and search for eventID 630 to find occurences corresponding to "deleted object user". Done !

If u are in ad2k3 u can reanimate yann by entering adrestore -r yannn and choose the right user to restore.

NB1: in order to use adrestore, u *must* be domain admins.
NB2: are u from Papeete tahiti ? because it's my homeland man ! I leave tahiti for now 10 years to France where i work in an AD & Exchange team. So .... iaorana ! ;o)
NB3: for those whose wondering what i am talking about.... iaorana means both "hello" or "goodbye" in tahitian language, depending if u arrive or leave :).
NB4: Tim, thanks a lot for your blog. It will leverage our skills on the underground technology of AD . Keep up the good work !

Yann

re: The Goodness that is Repadmin.exe

IanCurtis — Wed, 14 Jun 2006 22:40:38 GMT

Looking at your blog, can I use this to see where a user account was deleted. I've got doubts about my office in Papeete.

IC