Problem: Delete "deleted objects" in Samba

[scheinig]

Sympthom

You tried to delete an already deleted object in samba. Perhaps you followed this article

Samba 4 - Deleted Objects

Samba 4 - How to deal with Deleted Objects If you use UCS in Version < 4.2 you can follow the next Steps. If you use UCS >4.2 see further down. Deleted Objects Active Directory stores Deleted Objects for a while instead of removing them directly. This procedure is justified by the replication mechanism and will not cause any problems in general. It can occur that old references at objects will be updated and point to Deleted Objects - this could be an issue - for example if using a deleted obje…

and you stumble across this error message with this delete command.

ldbdel --cross-ncs --show-deleted --relax -r -H /var/lib/samba/private/sam.ldb 'cn=christina\0ADEL:891c4c0d-ff30-4acd-9dbb-c24ed355fc0d,CN=Deleted Objects,DC=schein,DC=me' delete of 'cn=christina\0ADEL:891c4c0d-ff30-4acd-9dbb-c24ed355fc0d,CN=Deleted Objects,DC=schein,DC=me' failed - (Operations error) (null)

What could go wrong here? It should be possible to delete this object.

Solution

The error message is quite misleading. The parameter -r for recursive cannot be combined with the parameter --relax

ldbdel --cross-ncs --show-deleted --relax -H /var/lib/samba/private/sam.ldb 'cn=cluwitsch2\0ADEL:891c4c0d-ff30-4acd-9dbb-c24ed355fc0d,CN=Deleted Objects,DC=schein,DC=me' Deleted 1 record

Important additional note:
If the parameter --relax is necessary:

Refusing to delete xxx This check is to prevent corruption of 
the replicated state

than the delection has to be done on each drs replication partner in the domain, otherwise the drs replication gets stuck!