Return
-
Title
HOW TO: Use an Active Roles Automation Workflow to delete a computer object with leaf objects -
Description
When using an Automation Workflow to find and delete a computer object, the operation fails with the following error message:You do not have sufficient privileges to delete 'CN=Computer,OU=Container,DC=Domain,DC=Local', or this object is protected from accidental deletion. The directory service can perform the requested operation only on a leaf object. (Exception from HRESULT: 0x80072015) -
Cause
This is expected functionality.
An Active Roles Delete activity is equivalent to selecting an object, deleting it, and confirming the deletion in native Active Directory tools.
When deleting a computer object which contains a leaf object in native Active Directory tools , a separate confirmation is required for each individual leaf object. Within finding and deleting these objects separately first, Active Roles cannot delete the computer object.
-
Resolution
Inside the existing Search activity, drag in another Search activity, and set the search root of the new activity to be the results of the first search. Then, delete all of the objects that that are found inside this search before deleting the computer.