Author Posts

June 1, 2017 at 7:15 pm

I'm trying to find out when was an ad-object deleted

Get-ADObject -Filter {(isdeleted -eq $true) -and (name -ne "Deleted Objects")} -includeDeletedObjects -property *

Doesn't show when it was deleted .. Just curious, is there a way to find out ?

June 1, 2017 at 9:24 pm

It's not particularly straightforward. I really recommend watching Ashley McGlone's AD Forensics session from Summit 2016. The whole video is worth watching but to answer your specific query, watch from 30 minutes onwards: