AD-CFG-05: Recycle bin enabled paths should be retrievable
| ID | AD-CFG-05 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Directory configuration |
| Security area | Infrastructure hardening |
| Resource type | Tenant |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Recycle Bin enabled paths indicate which naming contexts/partitions have AD’s Recycle Bin functionality turned on. This matters because the Recycle Bin is a major control for limiting damage from:
- Accidental deletions (including bulk removal mistakes)
- Insider misuse where deletion is used to cover tracks
- Operational failures where objects must be restored quickly to resume secure workflows
Without Recycle Bin enabled for the right partitions, deleted objects may be irrecoverable once tombstone/purge timelines are exceeded.
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”- Enable Recycle Bin for all partitions that store security-critical objects (for example, identity data in domains/NCs you manage).
- Ensure your recovery playbooks explicitly reference Recycle Bin vs. tombstone recovery.
- Monitor for unexpected changes to enabled partitions and investigate immediately.
How the Test Works
Section titled “How the Test Works”This test enumerates AD partitions/paths and reports which ones have Recycle Bin enabled, giving administrators direct visibility into recoverability coverage.
Related Tests
Section titled “Related Tests”Test-MtAdRecycleBinStatus- Confirms overall Recycle Bin functionality state.
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.