Error when removing AD accounts wth child objects - 6003 (CANT_ON_NON_LEAF)

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello Team.

Recently we have stumbled upon the error mentioned in the title dring termination of AD accounts from IdentityNow. These accounts have child objects connected to their AD accounts which are interfering with the cloud rule that is deleting AD accounts on termination.

Currently we are using the “Services Standard IdentityNow BeforeProvisioning Rule” which is a Cloud Rule Sailpoint implemented into our tenant and lets us delete AD accounts at a certain LCS. Documentation for that rule: Services Standard IdentityNow BeforeProvisioning Rule - README.pdf (68.5 KB)

To remove AD accounts with child objects it seems like we need to use the -Recursive command in Powershell but I don’t see how that is possible as we are using this generic Rule.

Is there any way to fix this issue, either via the Rule or somehow inside of Active Directory without having to execute any external script?

Error screenshot:
image

1 Like
2

Hello Sebastian,
Where u able to fix the issue?
If so pls share as i have a similar issue.

Thanks

3

I would suggest trying to add a Deletion Policy on the source (create-provisioning-policy | SailPoint Developer Community) which has a field named deleteSubTree with a boolean value of true. See these associated Compass articles for more info:

Always good to check on the permissions of your service account as well.

4

Is this possible for IdentityNow? The posts you linked to are both IIQ related.

5

Hello Michael!

Yes,
We are now using a powershell script via a BeforeModify Rule to delete all leaf-objects on user accounts at a certain lifecycle state in Active Directory.

6

The connector framework is the same as IIQ, so you just need to set up the policy with the API endpoint I provided.