Unsolved Active Directory Recycle Bin Question

---

I've restored deleted Users and Groups using AD Recycle Bin, however I cannot restore a user who was removed from a group in the MS Lab.

The reason that this is aggravating me is because of a test question I came across of :

Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. All
domain controllers run Windows Server 2012 R2.
The domain contains two domain controllers. The domain controllers are configured as shown in the following
table.

Active Directory Recycle Bin is enabled.
You discover that a support technician accidentally removed 100 users from an Active Directory group named
Group1 an hour ago.
You need to restore the membership of Group1.
What should you do?

A. Recover the items by using Active Directory Recycle Bin.
B. Modify the is Recycled attribute of Group1
C. Perform tombstone reanimation.
D. Perform an authoritative restore.

They say the correct answer is A, but I don't see how that is possible given that I have done the exact same thing in the MS Lab and Users who are removed from a group do NOT show up in the Deleted Objects container.

This makes it extremely hard to study for the 70-411 test when taking practice tests give you the wrong answer. The only answer that makes sense to me is D because the users are not deleted.

Anyone have insight that can explain why A is the answer?

Hello Nathan,

I would agree with your answer. Either the question is worded incorrectly, and they meant 'deleted' 100 users, or the answer is incorrect, at least in my opinion
Who created the practice test? Most practice test providers have some way of challenging a question, so they can tell you if they were wrong, which they are occasionally, or explain why their answer is correct.

Let me know what you find out,
Mike

I haven't gone back through the courses in the last couple of months; however, some common pitfalls with this and someone learning. Using the AD REcycle Bin requires that you do so with a Domain ADmin account. I'm not familiar with the virtual environments that were recently set up for us yet but if you are not explicitly doing so through something like:

$cred = Get-Credential -credential CONTOSO\Admin
then typing the password into the field that pops up, then clicking OK to save it to the cred variable.

Then when you do the commandlet:
Get-ADObject -Filter <FilterForObjective> -includeDeletedObjects -credential $cred

When that then returns the list you want, you would pipe it to " | Restore AD-Object"

and those accounts would be restored. The important point of mentioning all this is that if you do not explicitly use your credential in the search, the results coming from the Recycle Bin are hidden. This can cause it to appear as if there are no results, leading to much frustration.