Active Directory User and Group Restore
** Step 1 Determine if the deletion has already replicated to all of your Global Catalog DC's. If there is a latent GC/DC that has not processed any part of the deletion, then disconnect it from the network or disable inbound replication with the repadmin.exe command. (repadmin /options dc_name +DISABLE_INBOUND_REPL) If there isn't a latent DC, then you will have to find a recent system state backup from a GC/DC from the domain where the deletion occurred. Step 2 Reboot the recovery DC into DS restore mode and perform an authoritative restore (or if you did not find a latent DC, restore the system state and then perform the authoritative restore) Step 3 If you did not have to restore the system state, reboot normally. Reboot with the network cable disconnected if you did restore the system state, and then disable inbound replication with the repadmin command. Initiate outbound replication to all dc's in the domain (and gc's in the forest) with the repadmin /syncall comm...