| Previous | Next |
| ERROR_DS_CANT_MIX_MASTER_AND_REPS | ERROR_DS_OBJ_NOT_FOUND |
ERROR_DS_CHILDREN_EXIST
Regular delete requires a leaf object
LDAP Delete identifies a single entry. Active Directory normally permits deletion only when the target has no descendants. The presence of child objects changes the operation from deleting one entry to deleting a subtree, and the server does not silently infer recursive deletion because that would change the scope and risk of the request.
Enumerate one-level children on the same server before deciding how to proceed. If recursive removal is intentional, Active Directory defines the tree-delete control and processes descendants from leaves upward. Tree delete has its own continuation and access-check behavior; repeatedly issuing a plain Delete against the parent will continue to fail while children remain.
What to inspect
- Run a one-level search under the target DN to identify descendants.
- Delete or move children explicitly when selective cleanup is required.
- Use LDAP_SERVER_TREE_DELETE_OID only when recursive deletion is genuinely intended.
References
- MS-ADTS: Active Directory Delete operation
- MS-ADTS: tree-delete operation
- MS-ADTS: LDAP extended controls supported by Active Directory
Looking for a different code? Search another status or error code.