PIM Manager error codes

pim-ad-0101 The hybrid worker may not delete groups in Active Directory

What it means

Active Directory refused the approved deletion of old PIM groups, because the hybrid worker may not delete groups in the OU for new AD groups yet. Nothing was deleted in Active Directory. The groups and their members stay as they are; everything else the worker does keeps working.

What to do

1. You: On a domain controller, as a domain administrator, run these two lines with the values used at the install (Settings > Hybrid Active Directory in PIM Manager shows them with your OU filled in): Invoke-WebRequest https://invardia.com/support/pim/Initialize-PimHybridWorkerAd.ps1 -OutFile Initialize-PimHybridWorkerAd.ps1 -- then -- .\Initialize-PimHybridWorkerAd.ps1 -WorkerComputerName <worker> -ComputerOu '<OU of the worker computer>' -GmsaOu '<OU of the gMSA>' -GroupsOu '<OU for new AD groups>' -AllowGroupCleanup. It grants the one right "Delete Group objects" on that OU and changes nothing else.
2. Nobody - nothing to do: The worker deletes the approved groups at its next run (about hourly) and the status turns OK by itself. An approval that expired meanwhile is approved again on the same page.

Applies to

• Needs: hybridAd

Written by the PIM Manager team; Invardia publishes it. Quote the code when you contact support@invardia.com. · All PIM Manager error codes