> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/deleted-ad-objects-and-acl-persistence.md).

# Deleted AD Objects & ACL Persistence

### What is AD Soft Deletion (Tombstoning)?

When you delete an AD account, it isn't immediately removed from the database. Instead it becomes a **tombstone,** a stripped-down object stored in the `Deleted Objects` container. By default tombstones persist for 180 days before being permanently purged.

The important detail: **ACL entries on the object are preserved** even after deletion.

### Why Deleted Objects Are Dangerous ?

If user A had `GenericAll` or `WRITE` over user B before B was deleted, user A **still has that permission** over the tombstoned object. This means user A can restore B, inheriting whatever group memberships and privileges B originally had.

### Finding Deleted Objects with Write Access

```bash
# bloodyAD — shows all writable objects including deleted ones
bloodyAD --host dc01.domain.htb -d domain.htb \
  -u alex.turner -p 'password' get writable

# Output to look for:
# distinguishedName: CN=Mark Davies\0ADEL:...,CN=Deleted Objects,...
# permission: WRITE
```

```powershell
# PowerShell — enumerate deleted objects
Get-ADObject -Filter * -IncludeDeletedObjects -SearchBase "CN=Deleted Objects,DC=domain,DC=htb"

# Check ACL on a deleted object
Get-ADObject -Filter {Name -eq "mark.davies"} -IncludeDeletedObjects | Get-ACL
```

### Restoring a Deleted Account

```bash
# bloodyAD (one command)
bloodyAD --host dc01.domain.htb -d domain.htb \
  -u alex.turner -p 'password' set restore mark.davies

# PowerShell
Restore-ADObject -Identity "<GUID of deleted object>"
```

After restoration the account returns to its original OU with its original group memberships — including any share permissions or ACL rights it held before deletion.

### Defence

* After deleting accounts, explicitly strip non-default ACEs from the tombstoned object
* Audit Deleted Objects container regularly for lingering write permissions
* Monitor Event ID **4742** (account changes) and **4722** (account enabled) for unexpected account restorations
* Use `Get-ADObject -IncludeDeletedObjects | Get-ACL` in periodic audits


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/deleted-ad-objects-and-acl-persistence.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.