Right-click AdRestoreNet.exe and select Run as Administrator . The tool requires domain admin privileges or delegated permissions to read tombstones and restore objects.
Click "Enumerate Tombstones." Depending on your domain size, this may take 5–30 seconds. adrestorenet the gui version of adrestore
So next time someone accidentally vaporizes a critical security group or an entire department’s user accounts, skip the frantic Googling of command-line syntax. Download AdRestoreNet—the GUI version of AdRestore—and get back to business in minutes. Disclaimer: AdRestoreNet is a third-party utility not officially supported by Microsoft. Always test recovery procedures in a lab environment first. Ensure you have proper backups and adhere to your organization’s change management policies. Right-click AdRestoreNet
How does it work? When you delete an object in AD (User, Computer, Group, or Container), Windows marks it as a "tombstone." For a configurable period (typically 180 days in modern Windows Server versions), the object remains in the database but is hidden from normal LDAP queries. AdRestore queries these tombstones and, with a simple flag, can bring them back to life. So next time someone accidentally vaporizes a critical
While Mark Russinovich’s original adrestore.exe remains a powerful staple for scripting and remote recovery, It takes the precise, unforgiving nature of tombstone recovery and transforms it into a few mouse clicks.
Enter the name of a writable DC (or leave blank to auto-discover). Click "Connect."