Announcing the Saviynt Knowledge Exchange unifying the Saviynt forums, documentation, training,
and more in a single search tool across platforms. Read the announcement here.

Active Directory cannot delete child objects even ENFORCE_TREE_DELETION is ture

oscarcheng
New Contributor III
New Contributor III

We encountered the error message when removing certain AD accounts

oscarcheng_0-1716288895961.png

"Cannot delete object as object contains child objects also.Please enable EnforceTreeDeletion configuration or contact Administrator for more details. - [LDAP: error code 66 - 00002015: UpdErr: DSID-031A121E, problem 6003 (CANT_ON_NON_LEAF), data 0 ] "

Have searched the forum and we are advised to turn on the ENFORCE_TREE_DELETION but in vain
oscarcheng_1-1716288967330.png

Any suggestion? or any other additional rights is required?

2 REPLIES 2

Raghu
Honored Contributor
Honored Contributor

@oscarcheng  Can you check AD Team , Error saying don't have fully permission to delete account in AD.

 

 


Thanks,
Raghu
If this reply answered your question, Please Accept As Solution and hit Kudos.

rushikeshvartak
All-Star
All-Star

You are not deleting all childs

The LDAP error code 66 (CANT_ON_NON_LEAF) specifically indicates that the object you are trying to delete has child objects, and Active Directory is configured to prevent the deletion of non-leaf objects. To delete such an object, you need to either remove the child objects first or enable the tree deletion feature.


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.