Cannot delete old AD User Account

I have a few terminated employees who I cannot delete their Active Directory Accounts.

1. Protect object from accidental deletion is unchecked
2. I am a "Domain Admin", the user is a regular user account (not elevated)

The error I receive is:

Active Directory Domain Services
You do not have sufficient privileges to delete CN=Touchdownxyzxyzetcetc,CN=ExchangeActiveSyncDevices,CN=lastname\, firstname,OU=Terminations,DC=domain,DC=local, or this object is protected from accidental deletion.

The accounts havent had Exchange mailboxes for about 6 months. Is this going to be an ADSIEdit deletion required? If so, does anyone have a link on how to do this please OR other method to force the deletion.

Thanks in advance.
Christian HansAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

DrDave242Commented:
You do not have sufficient privileges to delete CN=Touchdownxyzxyzetcetc,CN=ExchangeActiveSyncDevices,CN=lastname\, firstname,OU=Terminations,DC=domain,DC=local, or this object is protected from accidental deletion.

Check this first, and note that the object in the error doesn't appear to be the user account itself. In AD Users and Computers, click the View menu and select Advanced Features. Then right-click the object in the error, select Properties, and select the Object tab. If the Protect object from accidental deletion box is checked, uncheck it, click OK, and attempt to delete the object again.
1
DrDave242Commented:
OK, I didn't read the question carefully enough. You won't be able to see that object in AD Users and Computers, since it's a child object of the user account. I've read that right-clicking the user account, selecting the Security tab, clicking Advanced, and then clicking Restore Defaults may reset the permissions on that Activesync object and allow you to delete it.

If that doesn't work, ADSIEdit may be the way to go:
  1. Run adsiedit.msc at an elevated command prompt.
  2. Right Click "ADSI Edit" in the left pane and select "Connect to..."
  3. Make sure "Default naming context" is selected in the "Select a well known Naming Context" dropdown and click OK.
  4. Expand Default naming context, your domain name, OU=Terminations, and one of the affected user accounts.
  5. You should see a container named CN=ExchangeActiveSyncDevices inside the user object, and inside that container there should be at least one object. Right-click that object and delete it.

You should then be able to delete the user account normally.
1

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Naveen SharmaCommented:
Refer to this earlier discussion may point you: https://social.technet.microsoft.com/Forums/ie/en-US/a6f10fa9-cda3-41f3-99f2-8d5c350bbfef/you-do-not-have-sufficient-privileges-to-delete-etc-but-this-is-different?forum=winserverDS

In ADUC-> View->Advanced Features.  Then, right click the object you're attempting to delete and select Properties. In the object tab, uncheck the "Protect object from accidental deletion" box.
0
Christian HansAuthor Commented:
Thanks Dr Dave, "right-clicking the user account, selecting the Security tab, clicking Advanced, and then clicking Restore Defaults may reset the permissions on that Activesync object and allow you to delete it." worked like a charm!
1
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.