Unable to delete computer objects since updating to 8.5

Hi. 

I am experiencing this issue as well. Rather annoyingly its been open since 8.3 and yet they allowed the product to move to 8.6 knowing this issue exists. Its down as a defect.

 To say I am rather Pi$$ed off is an understatement

https://support.oneidentity.com/active-roles/kb/4383759/computer-object-with-leaf-object-cannot-be-deleted

Ah, thanks Craig, I didn't find that article. Darn it!!  I updated to fix the issue with the exchange online delegates not displaying properly, only to be hit with this.  Not great!

I only upgraded to fix an issue with Dynamic groups constantly rebuilding on any attribute change which was hammering my AR servers. I think i could have lived with that rather than the impact of not being able to delete computer objects and the service desk emailing me all the time. 

@craig mcfarlane

What happens if you do this in a powershell?

$service="FQDN of Active Roles Admin Server"
$computerOjbect="some computer samaccountname"

$Connection = Connect-QADService `
    -Proxy `
    -Service $service

$Computer = Get-QADComputer `
    -Identity $ComputerObject `
    -Connection $Connection

Remove-QADObject -Identity $Computer.DN  `
                 -Connection $Connection `
                 -Force `
                 -DeleteTree 

I'm guessing this won't work because it's been my understanding that the issue resides within the Admin Service.  Others have reported that their Admin Service user can natively delete the computers (i.e. when you do RunAs with ADUC).

My suspicion is that there's a wayward deletion protection flag that somehow got set in the Admin Service DB.

I looked at the ACL's of both the parent computer objects, and leaf object or objects.  In my use case, the parent object, nor it's leaf objects had the protection turned on.  

 $Children = Get-QADObject `
    -SearchScope OneLevel `
    -SearchRoot $Computer.DN `
    -IncludedProperties ProtectedFromAccidentalDeletion `
    -Connection $Connection

foreach($Object in $Children){

(Get-Acl "AD:$Object").Access |
    Format-Table `
        IdentityReference,
        AccessControlType,
        ActiveDirectoryRights,
        IsInherited -AutoSize

Get-QADObject $Object -IncludedProperties ProtectedFromAccidentalDeletion -Connection $Connection | select name,ProtectedFromAccidentalDeletion
} 

I was able to successfully delete the object using the cmdlet on this object, but as the other commenters mentioned, the ARS MMC throws an error.

You looked at the native ACLs right?  I believe the problem resides in the "virtual ACL" in the AR database.

Yes correct, i checked them on the DC as well using the native tools.  All replied false.

I'm wrestling with this issue with a client that just upgraded to 8.2.1 and is planning to not upgrade too soon since this one was bumpy.