• State Suggested Answer
  • +1 person also asked this people also asked this
  • Replies 9 replies
  • Answers 2 answers
  • Subscribers 68 subscribers
  • Views 884 views
  • Users 0 members are here
Options
Related

Unable to delete computer objects since updating to 8.5

charleneforbes

Hi,

I updated from 8.2.1 to 8.5 a couple of days ago and the update went fine but since then no one, not even the AR admins, can delete computer objects.  I thought it was the msFVE-RecoveryInformation objects they couldn't delete, but it worked before the update.  I' followed the instructions in this link but it didn't help.  Unable to delete computer objects with BitLocker subtree/leaf object (4226632)

Delegates have full control of computer objects and delete child objects access to the OUs they're in, but even the AR admins like me can't delete computers.  The initial message that comes up when we try to delete one is for the recovery info and that comes up with an error Administrative Policy returned an error, object reference not set to an instance of an object.  If I say no to deleting the recovery info I then get to the message about deleting the computer itself, but trying to delete that comes up with a message saying You do not have sufficient privileges to delete......this object is protected from accidental deletion.  The directory service can perform the requested operation only on a leaf object.  I've checked the the computers are NOT protected from deletion (we can delete the same object directly in AD) and enabling the protection then removing it didn't make any difference.  I even ran native AD as the service account and could delete a computer with that, so it['s only via Active Roles itself it doesn't work. Very confusing!

Any ideas? Has anyone else come across this?

Thanks

Parents
  • 0

    Hi. 

    I am experiencing this issue as well. Rather annoyingly its been open since 8.3 and yet they allowed the product to move to 8.6 knowing this issue exists. Its down as a defect.

     To say I am rather Pi$$ed off is an understatement

    https://support.oneidentity.com/active-roles/kb/4383759/computer-object-with-leaf-object-cannot-be-deleted

  • 0 in reply to craig mcfarlane

    @craig mcfarlane

    What happens if you do this in a powershell?


    $service="FQDN of Active Roles Admin Server"
$computerOjbect="some computer samaccountname"

$Connection = Connect-QADService `
    -Proxy `
    -Service $service

$Computer = Get-QADComputer `
    -Identity $ComputerObject `
    -Connection $Connection

Remove-QADObject -Identity $Computer.DN  `
                 -Connection $Connection `
                 -Force `
                 -DeleteTree

  • 0 in reply to leejohnc

    I'm guessing this won't work because it's been my understanding that the issue resides within the Admin Service.  Others have reported that their Admin Service user can natively delete the computers (i.e. when you do RunAs with ADUC).

    My suspicion is that there's a wayward deletion protection flag that somehow got set in the Admin Service DB.

  • 0 in reply to JohnnyQuest

    I looked at the ACL's of both the parent computer objects, and leaf object or objects.  In my use case, the parent object, nor it's leaf objects had the protection turned on.  

     $Children = Get-QADObject `
        -SearchScope OneLevel `
        -SearchRoot $Computer.DN `
        -IncludedProperties ProtectedFromAccidentalDeletion `
        -Connection $Connection

    foreach($Object in $Children){

    (Get-Acl "AD:$Object").Access |
        Format-Table `
            IdentityReference,
            AccessControlType,
            ActiveDirectoryRights,
            IsInherited -AutoSize

    Get-QADObject $Object -IncludedProperties ProtectedFromAccidentalDeletion -Connection $Connection | select name,ProtectedFromAccidentalDeletion
    } 

    I was able to successfully delete the object using the cmdlet on this object, but as the other commenters mentioned, the ARS MMC throws an error.

Reply
  • 0 in reply to JohnnyQuest

    I looked at the ACL's of both the parent computer objects, and leaf object or objects.  In my use case, the parent object, nor it's leaf objects had the protection turned on.  

     $Children = Get-QADObject `
        -SearchScope OneLevel `
        -SearchRoot $Computer.DN `
        -IncludedProperties ProtectedFromAccidentalDeletion `
        -Connection $Connection

    foreach($Object in $Children){

    (Get-Acl "AD:$Object").Access |
        Format-Table `
            IdentityReference,
            AccessControlType,
            ActiveDirectoryRights,
            IsInherited -AutoSize

    Get-QADObject $Object -IncludedProperties ProtectedFromAccidentalDeletion -Connection $Connection | select name,ProtectedFromAccidentalDeletion
    } 

    I was able to successfully delete the object using the cmdlet on this object, but as the other commenters mentioned, the ARS MMC throws an error.

Children