Getting ERROR 412: conditionNotMet when deleting a user

[bstinson]

$ gam delete user us...@domain.com

ERROR: 412: conditionNotMet - Precondition is not met.

The user can't be deleted in the UI either but it doesn't tell me what the precondition is that isn't being met or if it is even related to the user. I know this isn't a problem with GAM because the UI exhibits the behavior too but hoping someone here might have the answer.

I tried accepting terms of service on the account and changing the password already.

[Ross Scroggs]

What does this show?

$ gam info user us...@domain.com

Ross

--

ross.s...@gmail.com

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/5295cb1f-f88c-43b7-a8fb-69388b21ec92n%40googlegroups.com.

[Jay Lee]

I've started seeing this also. What license does the user have? Delete the license first and then try deleting the user again.

Jay Lee

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/75E2D35A-BDD3-4637-86CD-B0BED8C0772B%40gmail.com.

[Jay Lee]

Also, admin console was returning an error on delete also, it doesn't seem to be GAM specific....

Jay Lee

[Bradley Stinson]

$ gam info user us...@domain.com

User: us...@domain.com

  Settings:

    First Name: [REDACTED]

    Last Name: [REDACTED]

    Full Name: [REDACTED]

    Languages: en

    Is a Super Admin: False

    Is Delegated Admin: False

    2-step enrolled: False

    2-step enforced: True

    Has Agreed to Terms: True

    IP Whitelisted: False

    Account Suspended: False

    Is Archived: False

    Must Change Password: False

    Google Unique ID: [REDACTED]

    Customer ID: [REDACTED]

    Mailbox is setup: True

    Included in GAL: True

    Creation Time: 2021-12-16T14:45:32.000Z

    Last login time: 2022-01-10T18:37:09.000Z

    Google Org Unit Path: [REDACTED]

  Addresses:

    type: work

      primary: True

  Organizations:

    customType: work

      name:

      location: [REDACTED]

      department: [REDACTED]

      title: [REDACTED]

      primary: True

  Relations:

    type: manager

      value: [REDACTED]

  Other Emails:

    type: alias

      address: [REDACTED]

  Phones:

    type: work

      value: [REDACTED]

  External IDs:

    type: organization

      value: [REDACTED]

  Websites:

    type: custom

      customType: [REDACTED]

      value: [REDACTED]

      primary: True

  Custom Schemas:

    Schema: [REDACTED]

      [REDACTED]

  Non-Editable Aliases: (1)

    alias: [REDACTED]

  Groups: (10)

    [REDACTED]

  Licenses: (1)

    [REDACTED] (Google Workspace Enterprise Plus)

Bradley Stinson| Application Engineer Application Engineering, Core Infra P: 480-327-0165 x22320

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/75E2D35A-BDD3-4637-86CD-B0BED8C0772B%40gmail.com.

[Bradley Stinson]

Removing the license worked Jay.

Bradley Stinson| Application Engineer Application Engineering, Core Infra P: 480-327-0165 x22320

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CA%2BVVBp-xjHh2yU3gTD2GU3%2B4iBdTCVhiHTiue-hSm%2Bsf%2BsyD1Q%40mail.gmail.com.

[Jay Lee]

I got more information on this precondition error. The specific issue is that the user is (or recently was) on litigation hold within the Google Vault tool. Deleting the user removes their on hold data (which is bad). You probably should not be deleting these users w/o understanding first why they were on hold and resolving that. Instead you likely want to suspend/archive said user.

Jay Lee

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAC6ikXEDDZ7dFmsWzjUh0Swx3QBxn1ApuVrpXS%3DgQQRMmLf-dQ%40mail.gmail.com.

[Nasos Papamatthaiou]

that's rather weird,

I'm facing the same issue and got the same response, that Jay mentions, from Google Support. However Google, all over its documentation emphasises to not delete the account if you want to maintain user's vault data. There's nowhere any info that claims a super admin won't be able to delete the account if there's a vault retention rule or hold.

However it might have sth to do with the license configuration, still investigating on this.

Nasos

[Bradley Stinson]

My user never even started with the company and so shouldn't have gone through our internal legal hold process where we would take those actions (although I haven't confirmed this). I wonder if there is some other setting related to vault that is making this apply.

Bradley Stinson| Application Engineer Application Engineering, Core Infra P: 480-327-0165 x22320

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/2bacb2b1-bcb4-47dc-a2df-cc07544803c6n%40googlegroups.com.

[Chris Deaton]

We ran into this issue also. We were able to fix it by identifying domain holds in vault that were improperly scoped to the root OU. These were older holds from 2015-2016. Once they were removed, we were able to delete as normal. Google did not announce this change unfortunately.

[Chris Deaton]

It's possible you're in the same boat we were in - check for domain wide holds in vault. If you have any, even newly created accounts will be in scope and won't be removable while the hold exists.

In talking with Google, this was a much asked for feature request, and it makes sense - Google admins managing account access may not necessarily be in lockstep with general counsel offices managing litigation holds, and could inadvertently destroy user data that was supposed to be in hold.

[bstinson]

That sounds likely Chris, thanks!

[Nasos Papamatthaiou]

I confirmed that too, we had a lingering test domain hold since 2015 that was the culprit. 

I wish Google wouldn't be so cryptic in revealing that change.

thanks Chris!

[Luis Zuniga]

this one just bit me

thanks all!

[Jay Lee]

You can use the latest version to see all the holds against a given user:

git.io/gam-releases

It should also tell you that thats the issue instead of the cryptic failed condition error 

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/00b11f16-be69-43ef-bcb7-944cae4cc37dn%40googlegroups.com.