2

I have one particular AD user, nothing really special about them that I'm aware of, that I'm unable to delete. The error is the "You do not have sufficient privileges to delete..." with the CN data which oddly has something about iPad App and ExchangeActiveSyncDevices in it and then "...or this object is protected from accidental deletion."

The accidental deletion protection option is off. I can't delete it from an account escalated to administrator nor from a full administrator login. This is not the only person with an iPad that has synced to our Exchange server. Is that a real clue or is it a misleading error? What else could be blocking deletion?

5
  • Can you view the object security privileges on that account? – Davidw Feb 22 '19 at 19:58
  • @Davidw Yes, and "Administrators" has "Full control" – Brian Knoblauch Feb 22 '19 at 20:11
  • 1
    Have you tried using an elevated Powershell prompt? – Davidw Feb 22 '19 at 20:16
  • 2
    If a user account has child objects, and the AD administrative account does not have the required permission on the child objects, that should be corrected. It's not unusual for AD administrative accounts to not have full permission to Exchange objects. – Greg Askew Feb 22 '19 at 20:45
  • OK, I can't remove that account from the Exchange admin center either. INSUFF_ACCESS_RIGHTS. I've never run into this before and it's definitely not my first time removing an Exchange user! :-) I'll investigate the child objects. – Brian Knoblauch Feb 22 '19 at 20:55
3

In AD Users and Computers, in the View menu, select the Users, Contacts, Groups and Computers as Containers option.

Find your user object there, and you'll probably see some sub-objects beneath the user object, such as certificates or similar things. To delete the user, right-click on the "folder" for the user object, and select Delete.

You will then probably get a prompt titled Confirm Subtree Deletion that explains the user object contains other objects (i.e. the certs or whatever). Just click OK to confirm deletion.

In Powershell, it's:

Remove-ADUser MyUser -recursive -Confirm:$false
7
  • Helpful, I can see there are a number of Exchange objects. Unfortunately I cannot delete them even with escalated powershell. :-/ – Brian Knoblauch Feb 26 '19 at 14:26
  • Have you tried deleting the account object (not the sub-objects) from the GUI? It should give you an error message if it can't. – LeeM Feb 26 '19 at 22:59
  • Indeed, I get a nice permission denied error. Even with the domain administrator account. Curious. Is there extra Exchange permissions that need to be added? – Brian Knoblauch Feb 28 '19 at 15:51
  • 1
    Sorry not to get back to this earlier. I'd be surprised if that was a problem. Maybe try granting Enterprise Admin to your account if you don't have it? Or yes, try adding yourself to Organization Management for Exchange. – LeeM Mar 13 '19 at 0:48
  • 1
    I came across an issue yesterday where I couldn't delete an obsolete Public Folder object. It wasn't an "access denied" error, it said "administrative limit reached". This turns out to be an issue if a multivalued attribute has exceeded the RangeUpper value for the property. In this case, the proxyAddresses attribute had > 1240 values, when the limit is 1123. Maybe check multivalued attribs on that account to see if any seem excessive? Might be interesting to try clearing all values from every non-mandatory attribute on the account, one by one (might narrow down any perm issue too). – LeeM Apr 2 '19 at 5:32
0

Got it finally! Had to go into ADSI Edit, find the user, go to the Exchange folder under her CN there. Open that up and take ownership (it was assigned to some random string instead of a real user). Once doing that I was able to give myself full security control on those objects that no one had control over before (including SELF). Finally once THAT was complete I could delete her account the normal way.

1
  • Excellent news! – LeeM Apr 28 '19 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.