Deletion of AD account with leaf is failing. is setting "deletesubtree" to true safe? and how can we do that?

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

8.4 P2

Please share any images or screenshots, if relevant.

image
image1822×461 159 KB

Share all details about your problem, including any error messages you may have received.

The error message is suggesting to set “deletesubtree” to true. Please let me know if it is a safer option to do that? or is there any other way to delete the AD account?

Also, Please share if there are steps involved for implementing the solution.

Thanks

Divya M

2

The error suggests that the account you are trying to delete has associated child object. You can work with your AD admins to find out what child objects is causing this error and if its ok to set the deletesubtree to true to delete the account and any associated child objects. You can check on the following post for reference.

https://community.sailpoint.com/t5/IdentityIQ-Forum/Active-Directory-connector-doesn-t-delete-user-object/m-p/122195

3

Create the delete provisioning policy , and create the attribute" *deletesubtree" and set this attribute to true.

That’s it, nothing more to do. Once implemented test a delete scenario and see if the flag is getting set, and you are not getting the error again.

4

Please set this optotion true , or please call ldapcontext api and try if that works. else go with native functionlity and set this attribute true