A bulk deletion may occur in a situation where an administrator selects and deletes a container object, such as an Organizational Unit, that has subordinate objects. Although bulk deletions are rare, they are disruptive events you can guard against by leveraging a new policy: Container Deletion Prevention.
One of the most common bulk deletions is a container deletion, which occurs when Active Roles is used to delete a container object that holds other (subordinate) objects. By default, a container deletion has the following characteristics:
-
First, Active Roles builds a list of all the objects found in the container (subordinate objects), and then starts deleting the listed objects one by one.
-
Then, for every object in the list, Active Roles performs an access check to determine if the user or process that requested the deletion has sufficient rights to delete the object. If the access check allows the deletion, then the object is deleted; otherwise, Active Roles does not delete the object, and proceeds to deletion of a subsequent object in the list.
-
Finally, once all the subordinate objects are deleted, Active Roles deletes the container itself. If any of the subordinate objects are not deleted, the container is not deleted as well.
As a result of this behavior, an administrator who has full control over an Organizational Unit in Active Roles can accidentally delete the entire Organizational Unit, with all its contents, within a single operation. To prevent this, Active Roles provides for a certain policy to deny deletion of non-empty containers.
The Container Deletion Prevention policy defines a configurable list of names of object types as specified by the Active Directory schema (for example, the Organizational Unit object type). When an Active Roles client requests the deletion of a particular container, the Administration Service evaluates the request in order to determine whether the type of the container is in the list defined by the policy. If the container type is in the list and the container holds any objects, the Administration Service denies the request, preventing the deletion of the container. In this case, the client prompts to delete all objects held in the container before attempting to delete the container itself.
To configure a Container Deletion Prevention policy
-
In the Console tree, select Configuration > Policies > Administration > Builtin.
-
In the details pane, double-click Built-in Policy - Container Deletion Prevention.
-
On the Policies tab, select the policy from the list and then click View/Edit.
-
On the Types of Containers tab, click Add and use the Select Object Type dialog to select the type (or types) of container you want to protect, and then click OK.
For example, you can select the Organizational Unit object type to prevent deletion of non-empty Organizational Units.
-
Click OK to close the dialogs you opened.
The built-in Policy Object you have configured using the above instructions prevents deletion of non-empty containers in any managed domain.
You may not want Active Roles to prevent deletion of non-empty containers that are outside a certain scope (such as a certain domain, Organizational Unit, or Managed Unit), whereas deletion should be prohibited on the non-empty containers that fall within that particular scope. In this scenario, you need to create and configure a copy of the built-in Policy Object and apply that copy to the scope in question. Then, block the effect of the built-in Policy Object by selecting the Disable all policies included in this Policy Object check box on the Policies tab in the dialog for managing properties of the Policy Object.
If you only need to allow deletion of non-empty containers within a certain scope, then you can simply block the effect of the built-in Policy Object on the object representing the scope in question. Thus, if you want to allow deletion of Organizational Units that fall within a certain Managed Unit, you can use the Enforce Policy command on that Managed Unit to display the dialog for managing policy settings and then select the Blocked check box next to the name of the built-in Policy Object.
