In Windows 2008, Microsoft introduced the ability to create and mount AD snapshots online, without having to reboot into Directory Services Restore Mode (DSRM).   By exposing an AD Snapshot, you can check to see if the backup set contains the deleted object in question. I also show a technique of using a 3rd party tool to copy attributes out of the snapshot and onto the reanimated object (normally you lose things like group membership and attributes when reanimated deleted objects).


In this  5 minute video, you will see how to perform a live recovery of a deleted object with all of its attributes intact.

An alternative to getting the user’s GUID is to use LDP.exe (resource kit utility) to bind against the snapshot