Active Directory non leaf objects not getting deleted even after updating EnforceTreeDeletion==True

[SaiMonika]

Hi Team,

Active directory non leaf objects are not getting deleted even after updating EnforceTreeDeletion==True in Saviynt.

Thanks,

SaiMonika

[NM]

---

@SaiMonika wrote:

Hi Team,

Active directory non leaf objects are not getting deleted even after updating EnforceTreeDeletion==True in Saviynt.

Thanks,

SaiMonika

---

@SaiMonika share error screenshot and connection config 

You have to remove child objects first or enable the tree deletion feature.

[rushikeshvartak]

1. Permissions Check

• Ensure that the account executing the deletion has the necessary permissions for all child objects within the container. Sometimes, permission inheritance issues can prevent the deletion of sub-objects.

2. Check for Active Directory Replication Issues

• If your environment has multiple domain controllers, replication delays or issues can interfere with deletion. Confirm that replication is working properly and that the domain controllers are in sync.

[SaiMonika]

Team,

Could you please provide what all attributes need to be verified.

Thanks,

SaiMonika

[rushikeshvartak]

Connection and Security System Configuration

• EnforceTreeDeletion: Confirm that EnforceTreeDeletion is correctly set to True in your connection configuration in Saviynt. This setting ensures that non-leaf nodes can be deleted.
• Delete Action Configurations: Ensure that REMOVEACCOUNTACTION (or any equivalent action that triggers deletion) is correctly mapped in the JSON configuration (e.g., DeleteAccountJSON) for the AD connector.
• Scope and Filter: Verify any filters or conditions defined in the connection properties that might limit deletion to specific objects or OUs.