Skip to content

Commit cf48c12

Browse files
v-liannav-lianna
authored
AB#4218 cannot-edit-delete-ad-object-error-sam
1 parent 334898b commit cf48c12

File tree

2 files changed

+187
-0
lines changed

2 files changed

+187
-0
lines changed

‎support/windows-server/active-directory/cannot-edit-delete-ad-object-error-sam.md‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
---
2+
title: Can't edit or delete an AD object and receive errors
3+
description: Helps resolve the issue in which you can't edit or delete an Active Directory (AD) object and receive an error "attribute is owned by the Security Accounts Manager (SAM)" or "The specified account does not exist".
4+
ms.date: 03/04/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: kaushika, herbertm, v-lianna
9+
ms.custom:
10+
- sap:active directory\user,computer,group,and object management
11+
- pcy:WinComm Directory Services
12+
---
13+
# Can't edit or delete an AD object and receive error "attribute is owned by the Security Accounts Manager (SAM)" or "The specified account does not exist"
14+
15+
This article helps resolve the issue in which you can't edit or delete an Active Directory (AD) object and receive an error "attribute is owned by the Security Accounts Manager (SAM)" or "The specified account does not exist".
16+
17+
You have a user, Managed Service Account (MSA), Group Managed Service Account (gMSA), computer or group object that is in use. When you attempt to delete a security principal from AD, you receive the following Lightweight Directory Access Protocol (LDAP) error:
18+
19+
> Operation failed. Error code: 0x525
20+
The specified account does not exist.
21+
00000525: NameErr: DSID-031A120B, problem 2001 (NO_OBJECT), data 0, best match of
22+
23+
When you retrieve properties of a computer object by using the following cmdlet:
24+
25+
```PowerShell
26+
get-adcomputer -identity oldcomputer -properties *
27+
```
28+
29+
You receive the following output:
30+
31+
```output
32+
CanonicalName : contoso.com/Workstations/Disabled/oldcomputer
33+
CN : oldcomputer
34+
Created : <DateTime>
35+
createTimeStamp : <DateTime>
36+
Deleted :
37+
Description :
38+
DisplayName :
39+
DistinguishedName : CN=oldcomputer,OU=Disabled,OU=Workstations,DC=contoso,DC=com
40+
dNSHostName : oldcomputer.contoso.com
41+
dSCorePropagationData : {<DateTime>, <DateTime>, <DateTime>, <DateTime>...}
42+
instanceType : 4
43+
isDeleted :
44+
LastKnownParent :
45+
Modified : <DateTime>
46+
modifyTimeStamp : <DateTime>
47+
Name : oldcomputer
48+
nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity
49+
objectCategory :
50+
ObjectClass : computer
51+
```
52+
53+
From the output, you notice an attribute excerpt and some key details:
54+
55+
- The object isn't deleted.
56+
- The `objectCategory` attribute is shown as empty.
57+
- The `sAMAccountType` attribute isn't listed.
58+
59+
When you try to edit the object, this error appears for most of the changes:
60+
61+
> 0x209a Access to the attribute is not permitted because the attribute is owned by the Security Accounts Manager (SAM).
62+
63+
When you check the metadata with the distinguished name (DN) get from the preceding output (excerpts of the attribute list) by using the following command, you receive unexpected results:
64+
65+
```console
66+
repadmin -showobjmeta DC01 "CN=oldcomputer,OU=Disabled,OU=Workstations,DC=contoso,DC=com"
67+
312781 DC12\0ADEL:AF9F2C0D-6B9F-4e32-A94D-A3E235A31BF7 98364396 YYYY-09-16 13:01:55 2 isDeleted
68+
...
69+
312781 83ddc6a9-65e8-4ace-8c84-8d1dd2778e47 104437043 YYYY-09-16 13:01:43 2 sAMAccountType
70+
...
71+
312781 83ddc6a9-65e8-4ace-8c84-8d1dd2778e47 104437043 YYYY-09-16 13:01:43 2 objectCategory
72+
...
73+
312781 DC12\0ADEL:AF9F2C0D-6B9F-4e32-A94D-A3E235A31BF7 98364396 YYYY-09-16 13:01:55 2 isRecycled
74+
```
75+
76+
Here is the interpretation of the metadata:
77+
78+
- The `sAMAccountType` and `objectCategory` attributes
79+
- They're usually set once.
80+
- The version is `2`, and they aren't set at this time. So they were removed during the object deletion, and were not re-populated during the undeletion.
81+
- The `isDeleted` attribute
82+
- The version also shows `2`. This means the object was deleted and was undeleted by clearing the attribute.
83+
- If the object was revived using an authoritative restore, the version numbers for all attributes would be higher (the default version increase is 100000).
84+
- The `isRecycled` attribute
85+
- It shows that at least at the time of the undeletion, Active Directory (AD) Recycle Bin was not enabled.
86+
- With AD Recycle Bin, the attribute would only be set on a recycled object.
87+
- Expected behaviors
88+
- If the undeletion worked as expected, the version of `sAMAccountType` and `objectCategory` would be an odd value (for example, `3`)
89+
- The timestamp for these attributes would match or be slightly newer than the timestamp for `IsDeleted`.
90+
91+
## The sAMAccountType and objectCategory attributes aren't added to the object in an undeletion process
92+
93+
The object was deleted and undeleted. Deleted objects don't have the `sAMAccountType` and `objectCategory` attributes. They are added to the object after the undeletion in the normal case. In the problem case, the process fails, leaving the object live without these key attributes.
94+
95+
## Use the fixupObjectState attribute with LDIFDE to repair the object
96+
97+
> [!NOTE]
98+
> This method includes the scenario where an object remains active without these attributes and can't be repaired or deleted.
99+
>
100+
> If the undeletion was done recently, you can restore the object using a backup in an authoritative restore. This also restores these attributes.
101+
102+
To resolve this issue, use the new facility included in Windows Server 2025 to repair broken objects as specified in [[MS-ADTS]: fixupObjectState](/openspecs/windows_protocols/ms-adts/37294765-9e7d-41a1-aded-2d6f744eee8c).
103+
104+
> [!NOTE]
105+
> There is also functionality to repair the `LastLogonTimeStamp` attribute. For more information, see [Will update link to the new article for this attribute].
106+
107+
### Step 1: Identify the object name and the globally unique identifier (GUID)
108+
109+
For example:
110+
111+
- DN: `cn=brokenuser,ou=bad-users,dc=contoso,dc=com`
112+
- GUID: `cf2b4aca-0e67-47d9-98aa-30a5fe30dc36`
113+
114+
### Step 2: Prepare an LDIFDE import file with the DN string or the GUID-based syntax
115+
116+
- Use the DN string:
117+
118+
```output
119+
DN:
120+
Changetype:modify
121+
add: fixupObjectState
122+
fixupObjectState: cn=brokenuser,ou=bad-users,dc=contoso,dc=com: sAMAccountType,objectCategory
123+
-
124+
```
125+
126+
> [!NOTE]
127+
> The line with only "-" and the empty line are required for a well-formed LDIFDE import file. This example requests to repair both Security Account Manager (SAM) relevant attributes.
128+
129+
- Use the GUID-based syntax:
130+
131+
If the object name contains special characters, use Unicode for the LDIF file, or use the GUID-based syntax.
132+
133+
An object name can be expressed as`<guid=cf2b4aca-0e67-47d9-98aa-30a5fe30dc36>` in the GUID-based syntax.
134+
135+
So, the expression of `fixupObjectState: cn=brokenuser,ou=bad-users,dc=contoso,dc=com:objectCategory, sAMAccountType` becomes `fixupObjectState: <guid=cf2b4aca-0e67-47d9-98aa-30a5fe30dc36>:objectCategory, sAMAccountType`.
136+
137+
To use this syntax with the LDIFDE import file, the text after the first colon needs to be encoded in Base64 format because of the greater-than (>) and less-than (<) signs:
138+
139+
```output
140+
fixupObjectState:: PGd1aWQ9Y2YyYjRhY2EtMGU2Ny00N2Q5LTk4YWEtMzBhNWZlMzBkYzM2PjpPYmplY3RjYXRlZ29yeSxTYW1BY2NvdW50VHlwZQ==
141+
```
142+
143+
> [!NOTE]
144+
> The double colon tells LDIFDE that the attribute value is in Base64 format. You can use the [Base64 encoder](https://www.bing.com/search?q=site%3Amicrosoft.com%20base64%20encoder&qs=n&form=QBRE&sp=-1&lq=0&pq=site%3Amicrosoft.com%20base64%20encoder&sc=0-33&sk=&cvid=CE994D44ADFC432CA2D3784CEBB3D934&ghsh=0&ghacc=0&ghpl=) to encode the string directly on the web.
145+
146+
Using the Base64 format, the import file updates the attributes individually:
147+
148+
- For the `sAMAccountType` attribute:
149+
150+
```output
151+
DN:
152+
Changetype:modify
153+
add: fixupObjectState
154+
fixupObjectState:: PGd1aWQ9Y2YyYjRhY2EtMGU2Ny00N2Q5LTk4YWEtMzBhNWZlMzBkYzM2PjpTYW1BY2NvdW50VHlwZQ==
155+
-
156+
```
157+
158+
- For the `objectCategory` attribute:
159+
160+
```output
161+
DN:
162+
Changetype:modify
163+
add: fixupObjectState
164+
fixupObjectState:: PGd1aWQ9Y2YyYjRhY2EtMGU2Ny00N2Q5LTk4YWEtMzBhNWZlMzBkYzM2PjpPYmplY3RjYXRlZ29yeQ==
165+
-
166+
```
167+
168+
### Step 3: Repair the object with LDIFDE
169+
170+
Sign in as an Enterprise Administrator, and import the LDIFDE import file with the following command by specifying the import file name (for example, **repair-user.txt**):
171+
172+
```console
173+
ldifde /i /f repair-user.txt
174+
Connecting to "<DC>"
175+
Logging in as current user using SSPI
176+
Importing directory from file " repair-user.txt"
177+
Loading entries...
178+
2 entries modified successfully.
179+
```
180+
181+
Then, the `objectCategory` and `sAMAccountType` attributes of the object are repopulated.
182+
183+
### Step 4: Delete the object again
184+
185+
Delete the object again, as the algorithm doesn't ensure the `sAMAccountType` attribute is correct for all cases. SAM allows a deletion with the new state of the object, but other operations with the object might fail. Additionally, the object might miss other crucial attributes for it to function properly.

‎support/windows-server/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -431,6 +431,8 @@ items:
431431
href: ./active-directory/fail-to-access-data-from-source-control-explorer.md
432432
- name: Can't add user or object to directory service
433433
href: ./active-directory/cannot-add-user-object-differ-by-diacritic-mark-character.md
434+
- name: Can't edit or delete an AD object
435+
href: ./active-directory/cannot-edit-delete-ad-object-error-sam.md
434436
- name: Can't start Active Directory Users and Computers Tool
435437
href: ./active-directory/cannot-start-active-directory-users-and-computers-tool.md
436438
- name: Compatibility with user accounts ending with the dollar sign

0 commit comments

Comments
 (0)