Unab installation completed but unable deregister UNAB endpoints

Products

• CA Privileged Identity Management Endpoint (PIM)
• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

The UNAB installation is successful, no error messages in the installation log
The servcies also start up properly.

The problem happens when we try to add and endpoint the output shows the endpoint is already registered.

When trying to deregister, we get an error message as below

Error message in text:

ldap_delete_s: Insufficient access (50)
        additional info: 00000005: SecErr: DSID-03152C2B, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

Failed to delete computer object from AD.

Environment

UNAB R12.8.x and 14.1.x

Cause

This is not a UNAB related error message, this message is being prompted from the Active Directory.

Resolution

This is AD routinely denying an operation (not UNAB problem).  Apparently, someone else registered originally that endpoint or some other that has some key attributes in common with it, and now a different account that is used for deregistration does not have privileges to ignore that and proceed.  

You can do the following:
(A) request AD admin to delete it on Windows ; or
(B) find out who owns that computer object and run deregistration using that account.