Bug 11064 - Impossible to delete group
Summary: Impossible to delete group
Status: RESOLVED WORKSFORME
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.1.11
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-21 20:19 UTC by Steinar H. Gunderson (dead mail address)
Modified: 2021-01-06 13:31 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Steinar H. Gunderson (dead mail address) 2015-01-21 20:19:20 UTC 
Hi,

I have a group (that I added myself) that's simply undeletable for some reason I cannot fathom:

root@voff:~# samba-tool group delete systemusers
ERROR(ldb): Failed to remove group "systemusers" - error in module samldb: Entry already exists during LDB_DELETE (68)

root@voff:~# net ads search '(CN=systemusers)'  
Got 1 replies

cn: systemusers
description: Domain Unix group
instanceType: 4
whenCreated: 20150111210848.0Z
uSNCreated: 36891
name: systemusers
objectGUID: 9a252745-af23-4878-8c63-50b6fd226379
objectSid: S-1-5-21-2179488501-3702089277-485037447-78069
sAMAccountName: systemusers
sAMAccountType: 268435456
groupType: -2147483646
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=ad,DC=samfundet,DC=no
msSFU30NisDomain: samfundet
memberOf: CN=Domain Users,CN=Users,DC=ad,DC=samfundet,DC=no
objectClass: top
objectClass: group
whenChanged: 20150121000400.0Z
uSNChanged: 62483
distinguishedName: CN=systemusers,CN=Groups,DC=ad,DC=samfundet,DC=no

Trying with LDAP manually gives the exact same error. I can modify the object (e.g. I already removed “objectclass: posixGroup” and “gidNumber: 100”), but I cannot delete it, even though it's not in use.

Turning up the debug level seems to indicate there's already something there:

[2015/01/21 21:17:36.446842, 10, pid=7017, effective(0, 0), real(0, 0), class=ldb] ../lib/ldb-samba/ldb_wrap.c:71(ldb_wrap_debug)
  ldb: ldb_trace_response: ENTRY
  dn: CN=sweep\0ADEL:f80857e2-7a7b-4f43-a0bf-7f1e9995c5c7,CN=Deleted Objects,DC=ad,DC=samfundet,DC=no
  whenChanged: 20150111185818.0Z

Could this be the reason for the confusing messages?
Comment 1 Rowland Penny 2021-01-06 13:31:05 UTC 
This was reported back in 2015 and there have been numerous changes to the code since then.
I created the same group 'systemusers' in my AD, using the same values on Samba 4.13.2
I was able to delete the group easily, so closing this bug report.