Bug 11064 - Impossible to delete group
Summary: Impossible to delete group
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.1.11
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
Depends on:
Reported: 2015-01-21 20:19 UTC by Steinar H. Gunderson (dead mail address)
Modified: 2021-01-06 13:31 UTC (History)
1 user (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Steinar H. Gunderson (dead mail address) 2015-01-21 20:19:20 UTC

I have a group (that I added myself) that's simply undeletable for some reason I cannot fathom:

root@voff:~# samba-tool group delete systemusers
ERROR(ldb): Failed to remove group "systemusers" - error in module samldb: Entry already exists during LDB_DELETE (68)

root@voff:~# net ads search '(CN=systemusers)'  
Got 1 replies

cn: systemusers
description: Domain Unix group
instanceType: 4
whenCreated: 20150111210848.0Z
uSNCreated: 36891
name: systemusers
objectGUID: 9a252745-af23-4878-8c63-50b6fd226379
objectSid: S-1-5-21-2179488501-3702089277-485037447-78069
sAMAccountName: systemusers
sAMAccountType: 268435456
groupType: -2147483646
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=ad,DC=samfundet,DC=no
msSFU30NisDomain: samfundet
memberOf: CN=Domain Users,CN=Users,DC=ad,DC=samfundet,DC=no
objectClass: top
objectClass: group
whenChanged: 20150121000400.0Z
uSNChanged: 62483
distinguishedName: CN=systemusers,CN=Groups,DC=ad,DC=samfundet,DC=no

Trying with LDAP manually gives the exact same error. I can modify the object (e.g. I already removed “objectclass: posixGroup” and “gidNumber: 100”), but I cannot delete it, even though it's not in use.

Turning up the debug level seems to indicate there's already something there:

[2015/01/21 21:17:36.446842, 10, pid=7017, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:71(ldb_wrap_debug)
  ldb: ldb_trace_response: ENTRY
  dn: CN=sweep\0ADEL:f80857e2-7a7b-4f43-a0bf-7f1e9995c5c7,CN=Deleted Objects,DC=ad,DC=samfundet,DC=no
  whenChanged: 20150111185818.0Z

Could this be the reason for the confusing messages?
Comment 1 Rowland Penny 2021-01-06 13:31:05 UTC
This was reported back in 2015 and there have been numerous changes to the code since then.
I created the same group 'systemusers' in my AD, using the same values on Samba 4.13.2
I was able to delete the group easily, so closing this bug report.