2

I have one particular AD user, nothing really special about them that I'm aware of, that I'm unable to delete. The error is the "You do not have sufficient privileges to delete..." with the CN data which oddly has something about iPad App and ExchangeActiveSyncDevices in it and then "...or this object is protected from accidental deletion."

The accidental deletion protection option is off. I can't delete it from an account escalated to administrator nor from a full administrator login. This is not the only person with an iPad that has synced to our Exchange server. Is that a real clue or is it a misleading error? What else could be blocking deletion?

5
  • Can you view the object security privileges on that account?
    – Davidw
    Feb 22, 2019 at 19:58
  • @Davidw Yes, and "Administrators" has "Full control" Feb 22, 2019 at 20:11
  • 1
    Have you tried using an elevated Powershell prompt?
    – Davidw
    Feb 22, 2019 at 20:16
  • 2
    If a user account has child objects, and the AD administrative account does not have the required permission on the child objects, that should be corrected. It's not unusual for AD administrative accounts to not have full permission to Exchange objects.
    – Greg Askew
    Feb 22, 2019 at 20:45
  • OK, I can't remove that account from the Exchange admin center either. INSUFF_ACCESS_RIGHTS. I've never run into this before and it's definitely not my first time removing an Exchange user! :-) I'll investigate the child objects. Feb 22, 2019 at 20:55

2 Answers 2

3

In AD Users and Computers, in the View menu, select the Users, Contacts, Groups and Computers as Containers option.

Find your user object there, and you'll probably see some sub-objects beneath the user object, such as certificates or similar things. To delete the user, right-click on the "folder" for the user object, and select Delete.

You will then probably get a prompt titled Confirm Subtree Deletion that explains the user object contains other objects (i.e. the certs or whatever). Just click OK to confirm deletion.

In Powershell, it's:

Remove-ADUser MyUser -recursive -Confirm:$false
7
  • Helpful, I can see there are a number of Exchange objects. Unfortunately I cannot delete them even with escalated powershell. :-/ Feb 26, 2019 at 14:26
  • Have you tried deleting the account object (not the sub-objects) from the GUI? It should give you an error message if it can't.
    – LeeM
    Feb 26, 2019 at 22:59
  • Indeed, I get a nice permission denied error. Even with the domain administrator account. Curious. Is there extra Exchange permissions that need to be added? Feb 28, 2019 at 15:51
  • 1
    Sorry not to get back to this earlier. I'd be surprised if that was a problem. Maybe try granting Enterprise Admin to your account if you don't have it? Or yes, try adding yourself to Organization Management for Exchange.
    – LeeM
    Mar 13, 2019 at 0:48
  • 1
    I came across an issue yesterday where I couldn't delete an obsolete Public Folder object. It wasn't an "access denied" error, it said "administrative limit reached". This turns out to be an issue if a multivalued attribute has exceeded the RangeUpper value for the property. In this case, the proxyAddresses attribute had > 1240 values, when the limit is 1123. Maybe check multivalued attribs on that account to see if any seem excessive? Might be interesting to try clearing all values from every non-mandatory attribute on the account, one by one (might narrow down any perm issue too).
    – LeeM
    Apr 2, 2019 at 5:32
0

Got it finally! Had to go into ADSI Edit, find the user, go to the Exchange folder under her CN there. Open that up and take ownership (it was assigned to some random string instead of a real user). Once doing that I was able to give myself full security control on those objects that no one had control over before (including SELF). Finally once THAT was complete I could delete her account the normal way.

1
  • Excellent news!
    – LeeM
    Apr 28, 2019 at 22:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .