Skip to content

Commit 7e1b278

Browse files
author
Simonx Xu
authored
Merge pull request #8365 from v-lianna/CI_4218
AB#4218 cannot-edit-delete-ad-object-error-sam
2 parents 36c3f63 + 1b36bae commit 7e1b278

File tree

2 files changed

+187
-0
lines changed

2 files changed

+187
-0
lines changed

‎support/windows-server/active-directory/cannot-edit-delete-ad-object-error-sam.md‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
---
2+
title: Can't Edit or Delete an AD Object and Receive Errors
3+
description: Helps resolve an issue where you can't edit or delete an AD object and receive the error Attribute is owned by SAM or The specified account does not exist.
4+
ms.date: 03/11/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: kaushika, herbertm, v-lianna
9+
ms.custom:
10+
- sap:active directory\user,computer,group,and object management
11+
- pcy:WinComm Directory Services
12+
---
13+
# Can't edit or delete an AD object and receive the error "attribute is owned by the Security Accounts Manager (SAM)" or "The specified account does not exist"
14+
15+
This article helps resolve an issue in which you can't edit or delete an Active Directory (AD) object and receive the error "attribute is owned by the Security Accounts Manager (SAM)" or "The specified account does not exist."
16+
17+
You have a user, Managed Service Account (MSA), Group Managed Service Account (gMSA), computer, or group object that is in use. When you attempt to delete a security principal from AD, you receive the following Lightweight Directory Access Protocol (LDAP) error:
18+
19+
> Operation failed. Error code: 0x525
20+
The specified account does not exist.
21+
00000525: NameErr: DSID-031A120B, problem 2001 (NO_OBJECT), data 0, best match of
22+
23+
When you retrieve the properties of a computer object by using the following cmdlet:
24+
25+
```PowerShell
26+
get-adcomputer -identity oldcomputer -properties *
27+
```
28+
29+
You receive the following output:
30+
31+
```output
32+
CanonicalName : contoso.com/Workstations/Disabled/oldcomputer
33+
CN : oldcomputer
34+
Created : <DateTime>
35+
createTimeStamp : <DateTime>
36+
Deleted :
37+
Description :
38+
DisplayName :
39+
DistinguishedName : CN=oldcomputer,OU=Disabled,OU=Workstations,DC=contoso,DC=com
40+
dNSHostName : oldcomputer.contoso.com
41+
dSCorePropagationData : {<DateTime>, <DateTime>, <DateTime>, <DateTime>...}
42+
instanceType : 4
43+
isDeleted :
44+
LastKnownParent :
45+
Modified : <DateTime>
46+
modifyTimeStamp : <DateTime>
47+
Name : oldcomputer
48+
nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity
49+
objectCategory :
50+
ObjectClass : computer
51+
```
52+
53+
From the output, you notice an attribute excerpt and some key details:
54+
55+
- The object isn't deleted.
56+
- The `objectCategory` attribute is shown as empty.
57+
- The `sAMAccountType` attribute isn't listed.
58+
59+
When you try to edit the object, this error appears for most changes:
60+
61+
> 0x209a Access to the attribute is not permitted because the attribute is owned by the Security Accounts Manager (SAM).
62+
63+
When you check the metadata with the distinguished name (DN) obtained from the preceding output (excerpts of the attribute list) by using the following command, you receive unexpected results:
64+
65+
```console
66+
repadmin -showobjmeta DC01 "CN=oldcomputer,OU=Disabled,OU=Workstations,DC=contoso,DC=com"
67+
312781 DC12\0ADEL:AF9F2C0D-6B9F-4e32-A94D-A3E235A31BF7 98364396 YYYY-09-16 13:01:55 2 isDeleted
68+
...
69+
312781 83ddc6a9-65e8-4ace-8c84-8d1dd2778e47 104437043 YYYY-09-16 13:01:43 2 sAMAccountType
70+
...
71+
312781 83ddc6a9-65e8-4ace-8c84-8d1dd2778e47 104437043 YYYY-09-16 13:01:43 2 objectCategory
72+
...
73+
312781 DC12\0ADEL:AF9F2C0D-6B9F-4e32-A94D-A3E235A31BF7 98364396 YYYY-09-16 13:01:55 2 isRecycled
74+
```
75+
76+
Here's the interpretation of the metadata:
77+
78+
- The `sAMAccountType` and `objectCategory` attributes
79+
- They're usually set once.
80+
- The version is `2`, and they aren't set at this time. So, they were removed during the object deletion and weren't repopulated during the undeletion.
81+
- The `isDeleted` attribute
82+
- The version also shows `2`. This means the object was deleted and was undeleted by clearing the attribute.
83+
- If the object was revived using an authoritative restore, the version numbers for all attributes would be higher (the default version increase is 100000).
84+
- The `isRecycled` attribute
85+
- It shows that at least at the time of the undeletion, the Active Directory (AD) Recycle Bin wasn't enabled.
86+
- When using the AD Recycle Bin, the attribute would only be set on a recycled object.
87+
- Expected behaviors
88+
- If the undeletion worked as expected, the version of `sAMAccountType` and `objectCategory` would be an odd value (for example, `3`).
89+
- The timestamp for these attributes would match or be slightly newer than the timestamp for `IsDeleted`.
90+
91+
## The sAMAccountType and objectCategory attributes aren't added to the object in an undeletion process
92+
93+
The object was deleted and undeleted. Deleted objects don't have the `sAMAccountType` and `objectCategory` attributes. They're added to the object after the undeletion in the normal case. In the problem case, the process fails, leaving the object active without these key attributes. This state of the object is a known problem that can't be reproduced, and the root cause of this sporadic problem hasn't been identified.
94+
95+
## Use the fixupObjectState attribute with LDIFDE to repair the object
96+
97+
> [!NOTE]
98+
> This method includes the scenario where an object remains active without these attributes and can't be repaired or deleted.
99+
>
100+
> If the undeletion was done recently, you can restore the object using a backup in an authoritative restore. This also restores these attributes.
101+
102+
To resolve this issue, use the new facility included in Windows Server 2025 to repair broken objects as specified in [[MS-ADTS]: fixupObjectState](/openspecs/windows_protocols/ms-adts/37294765-9e7d-41a1-aded-2d6f744eee8c).
103+
104+
> [!NOTE]
105+
> There's also functionality to repair the `LastLogonTimeStamp` attribute. For more information, see [User or computer accounts have the lastLogonTimestamp value set to a future time](accounts-lastlogontimestamp-future-time.md).
106+
107+
### Step 1: Identify the object name and globally unique identifier (GUID)
108+
109+
For example:
110+
111+
- DN: `cn=brokenuser,ou=bad-users,dc=contoso,dc=com`
112+
- GUID: `cf2b4aca-0e67-47d9-98aa-30a5fe30dc36`
113+
114+
### Step 2: Prepare an LDIFDE import file using the DN string or GUID-based syntax
115+
116+
- Use the DN string:
117+
118+
```output
119+
DN:
120+
Changetype:modify
121+
add: fixupObjectState
122+
fixupObjectState: cn=brokenuser,ou=bad-users,dc=contoso,dc=com: SamAccountType,Objectcategory
123+
-
124+
```
125+
126+
> [!NOTE]
127+
> The line with only a hyphen (`-`) and the empty line are required for a well-formed LDIFDE import file. This example requests the repair of both SAM-relevant attributes.
128+
129+
- Use the GUID-based syntax:
130+
131+
If the object name contains special characters, use Unicode for the LDIFDE import file, or use the GUID-based syntax.
132+
133+
An object name can be expressed as`<guid=cf2b4aca-0e67-47d9-98aa-30a5fe30dc36>` in the GUID-based syntax.
134+
135+
So, the expression of `fixupObjectState: cn=brokenuser,ou=bad-users,dc=contoso,dc=com:Objectcategory, SamAccountType` becomes `fixupObjectState: <guid=cf2b4aca-0e67-47d9-98aa-30a5fe30dc36>:Objectcategory, SamAccountType`.
136+
137+
To use this syntax with the LDIFDE import file, you need to encode the text after the first colon in Base64 format because of the greater-than (>) and less-than (<) signs:
138+
139+
```output
140+
fixupObjectState:: PGd1aWQ9Y2YyYjRhY2EtMGU2Ny00N2Q5LTk4YWEtMzBhNWZlMzBkYzM2PjpPYmplY3RjYXRlZ29yeSxTYW1BY2NvdW50VHlwZQ==
141+
```
142+
143+
> [!NOTE]
144+
> The double colon tells LDIFDE that the attribute value is in Base64 format. You can use the [Base64 encoder](https://www.bing.com/search?q=site%3Amicrosoft.com%20base64%20encoder&qs=n&form=QBRE&sp=-1&lq=0&pq=site%3Amicrosoft.com%20base64%20encoder&sc=0-33&sk=&cvid=CE994D44ADFC432CA2D3784CEBB3D934&ghsh=0&ghacc=0&ghpl=) to encode the string directly on the web.
145+
146+
After using the Base64 format, the import file updates the attributes individually:
147+
148+
- For the `sAMAccountType` attribute:
149+
150+
```output
151+
DN:
152+
Changetype:modify
153+
add: fixupObjectState
154+
fixupObjectState:: PGd1aWQ9Y2YyYjRhY2EtMGU2Ny00N2Q5LTk4YWEtMzBhNWZlMzBkYzM2PjpTYW1BY2NvdW50VHlwZQ==
155+
-
156+
```
157+
158+
- For the `objectCategory` attribute:
159+
160+
```output
161+
DN:
162+
Changetype:modify
163+
add: fixupObjectState
164+
fixupObjectState:: PGd1aWQ9Y2YyYjRhY2EtMGU2Ny00N2Q5LTk4YWEtMzBhNWZlMzBkYzM2PjpPYmplY3RjYXRlZ29yeQ==
165+
-
166+
```
167+
168+
### Step 3: Repair the object using LDIFDE
169+
170+
Sign in as an Enterprise Administrator, and import the LDIFDE import file with the following command by specifying the import file name (for example, **repair-user.txt**):
171+
172+
```console
173+
ldifde /i /f repair-user.txt
174+
Connecting to "<DC>"
175+
Logging in as current user using SSPI
176+
Importing directory from file " repair-user.txt"
177+
Loading entries...
178+
2 entries modified successfully.
179+
```
180+
181+
Then, the `objectCategory` and `sAMAccountType` attributes of the object are repopulated.
182+
183+
### Step 4: Delete the object again
184+
185+
Delete the object again, as the algorithm doesn't always ensure the `sAMAccountType` attribute is correct. SAM allows the object in the new state to be deleted, but other operations on the object might fail. Additionally, the object might lack other crucial attributes that make it function properly.

‎support/windows-server/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -433,6 +433,8 @@ items:
433433
href: ./active-directory/fail-to-access-data-from-source-control-explorer.md
434434
- name: Can't add user or object to directory service
435435
href: ./active-directory/cannot-add-user-object-differ-by-diacritic-mark-character.md
436+
- name: Can't edit or delete an AD object
437+
href: ./active-directory/cannot-edit-delete-ad-object-error-sam.md
436438
- name: Can't start Active Directory Users and Computers Tool
437439
href: ./active-directory/cannot-start-active-directory-users-and-computers-tool.md
438440
- name: Compatibility with user accounts ending with the dollar sign

0 commit comments

Comments
 (0)