Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-11106: How to protect SCP objects from being deleted in Active Directory?

Authentication Service ,  

24 September,18 at 02:52 PM

Question: How can we protect the Centrify SCP objects in Active Directory from being deleted?

Answer: The recommended solution for this is to protect the object from accidental deletion in Active Directory. You can do this manually or via powershell. 

1)Open ADUC
2)Go to the zone
3)Expand the computers container
4)Search for your SCP object
5)Properties Tab, on the 2nd tab (object), there is a check box ("protect object from accidental deletion")
6)Make sure that is checked and click OK

You can also do this with powerShell as an administrator, using a similar command to the one below. 

For the command below modify the DN name so that it points to the OU relevant for your domain. The below command will set this for all objects in the specified OU. 

Get-ADobject -Filter * -SearchBase “OU=Computers,DC=Domain,DC=com” | Set-adobject -ProtectedFromAccidentalDeletion $true

This creates a "deny" for deletion of the object. Now whoever tries to delete this will generate an event.
The user will have to remove this permission before the object can be deleted.