ldapdelete Command Cheat Sheet: Remove OpenLDAP Entries

About	ldapdelete removes LDAP entries by distinguished name. It supports one or more DNs on the command line, a DN file, and recursive subtree deletion when a non-leaf entry must be removed.
Tested on	Rocky Linux 10.2; OpenLDAP 2.6.10; openldap-clients from EPEL
Package	openldap-clients (apt/deb) · openldap-clients (dnf/rpm)
Man page	ldapdelete(1)
Privilege	bind DN with delete access
Distros	RHEL, Rocky Linux, AlmaLinux, Oracle Linux, CentOS Stream (openldap-clients package).
Related guide	Manage OpenLDAP users and groups Configure OpenLDAP TLS on RHEL

ldapdelete — quick reference

Delete DNs safely

Always search and verify the exact DN before deletion. A normal LDAP delete works only on leaf entries.

When to use	Command
Delete one known leaf entry	`ldapdelete -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "uid=alice,ou=people,dc=example,dc=com"`
Delete several quoted DNs in one invocation	`ldapdelete -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "uid=alice,ou=people,dc=example,dc=com" "uid=bob,ou=people,dc=example,dc=com"`
Delete DNs listed in a file, one per line	`ldapdelete -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f delete-dns.txt`
Keep processing later DNs after an error	`ldapdelete -c -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f delete-dns.txt`
Preview a delete request without applying it	`ldapdelete -n -v -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "uid=alice,ou=people,dc=example,dc=com"`
Supply a lab password non-interactively	`ldapdelete -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -w 'PASSWORD' "uid=alice,ou=people,dc=example,dc=com"`
Read the bind password from a root-only file	`ldapdelete -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -y /root/ldap-bind.txt -f delete-dns.txt`

Recursive deletion

-r deletes all descendant entries. It is deliberately separate from normal leaf deletion because it can remove a whole branch.

When to use	Command
Remove a disposable subtree after review	`ldapdelete -r -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "ou=staging,dc=example,dc=com"`
Raise the child-search size limit for `-r`	`ldapdelete -r -z 1000 -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "ou=staging,dc=example,dc=com"`
Recursively delete with verbose client tracing	`ldapdelete -r -v -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "ou=staging,dc=example,dc=com"`

Connection and debugging

When to use	Command
Require StartTLS for a simple bind	`ldapdelete -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "uid=alice,ou=people,dc=example,dc=com"`
Request StartTLS but allow fallback	`ldapdelete -x -Z -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "uid=alice,ou=people,dc=example,dc=com"`
Print LDAP library debug messages	`ldapdelete -d 1 -v -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "uid=alice,ou=people,dc=example,dc=com"`
Use LDAPv3 explicitly	`ldapdelete -P 3 -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "uid=alice,ou=people,dc=example,dc=com"`

Help

When to use	Command
Show usage	`ldapdelete -h`
Print version and exit	`ldapdelete -VV`

ldapdelete — command syntax

Synopsis from ldapdelete --help:

text


ldapdelete [-V[V]] [-d debuglevel] [-n] [-v] [-c] [-f file] [-r]
           [-z sizelimit] [-M[M]] [-x] [-D binddn] [-W] [-w passwd]
           [-y passwdfile] [-H ldapuri] [-P {2|3}]
           [-e [!]<ext>[=<extparam>]] [-E [!]<ext>[=<extparam>]]
           [-o opt[=optparam]] [-I] [-Q] [-Y mech] [-Z[Z]] [DN ...]

Quote every DN so the shell treats its commas and spaces literally. For the user lifecycle around a deletion, see managing OpenLDAP users and groups; start with OpenLDAP installation on RHEL when you need the server layout and suffix.

ldapdelete — command examples

Essential Inspect the exact DN before deletion

Read the candidate with a base-scope search before issuing a destructive operation.

bash

ldapsearch -x -LLL -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -b "uid=alice,ou=people,dc=example,dc=com" -s base "(objectClass=*)" uid cn

Sample output:

output

Enter LDAP Password:
dn: uid=alice,ou=people,dc=example,dc=com
uid: alice
cn: Alice Example

This confirms both the DN and the identity you are about to remove.

Essential Preview a delete with -n

-n prints what would be deleted without sending the delete request. Pair it with -v so the target DN appears on stderr.

bash

ldapdelete -n -v -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "uid=alice,ou=people,dc=example,dc=com"

Sample output:

output

ldap_initialize( ldap://localhost:389/??base )
Enter LDAP Password:
!deleting entry "uid=alice,ou=people,dc=example,dc=com"

The !deleting entry line is the safety check you want in a change window.

Essential Delete one leaf entry

Use the administrator bind with mandatory StartTLS to delete a confirmed user DN.

bash

ldapdelete -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "uid=alice,ou=people,dc=example,dc=com"

Sample output:

output

Enter LDAP Password:

ldapdelete is silent on a successful delete; verify immediately rather than treating silence as enough.

Essential Verify that the DN is gone

Search the removed DN with base scope after the operation.

bash

ldapsearch -x -LLL -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -b "uid=alice,ou=people,dc=example,dc=com" -s base "(objectClass=*)"

Sample output:

output

Enter LDAP Password:
No such object (32)
Matched DN: ou=people,dc=example,dc=com

The error is expected here: it proves the formerly known DN no longer exists.

Common Delete DNs listed in a file

For a reviewed cleanup list, put one full DN on each line and pass it with -f.

bash

ldapdelete -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f /root/delete-dns.txt

Sample output:

output

Enter LDAP Password:

This is safer than copy-pasting many DNs, provided the file was reviewed first.

Common Continue a bulk delete after one failure

-c keeps processing later lines in the file when one DN is already gone or invalid.

bash

ldapdelete -c -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -f /root/delete-dns.txt

Sample output:

output

Enter LDAP Password:
ldap_delete: No such object (32)
	matched DN: ou=people,dc=example,dc=com

The non-zero exit status still reports that at least one line failed, but remaining DNs were attempted.

Common Recognize a non-leaf delete failure

LDAP normally rejects removal of an entry that still has children.

bash

ldapdelete -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "ou=people,dc=example,dc=com"

Sample output:

output

Enter LDAP Password:
ldap_delete: Operation not allowed on non-leaf (66)
	additional info: subordinate objects must be deleted first

Delete or move children first; do not add -r until the whole subtree is explicitly disposable.

Advanced Delete a reviewed disposable subtree

-r recursively deletes descendants, so use it only after listing and approving the subtree. TLS setup belongs in the OpenLDAP TLS guide.

bash

ldapdelete -r -x -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "ou=staging,dc=example,dc=com"

Sample output:

output

Enter LDAP Password:

Success is silent, but the entire ou=staging branch and every child were removed.

Advanced Confirm a recursive delete removed the branch

Base-scope search on the former OU should fail after -r completes.

bash

ldapsearch -x -LLL -ZZ -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W -b "ou=staging,dc=example,dc=com" -s base "(objectClass=*)"

Sample output:

output

Enter LDAP Password:
No such object (32)
Matched DN: dc=example,dc=com

Matched DN shows the parent that still exists while the deleted OU does not.

Advanced Recognize a confidentiality-required bind failure

This server refuses a password bind without StartTLS.

bash

ldapdelete -x -H ldap://localhost -D "cn=admin,dc=example,dc=com" -W "uid=alice,ou=people,dc=example,dc=com"

Sample output:

output

Enter LDAP Password:
ldap_bind: Confidentiality required (13)
	additional info: confidentiality required

Add -ZZ and configure CA trust before retrying.

ldapdelete — when to use / when not

Use ldapdelete when	Use something else when
A complete leaf entry must be removed by DN You have a reviewed list of obsolete DNs A disposable subtree is explicitly approved for recursive removal You need a dry run before a maintenance window	You only need to remove an attribute → ldapmodify You need to confirm a DN first → ldapsearch You are creating a replacement entry → ldapadd You need to confirm which identity is bound → ldapwhoami

ldapdelete vs ldapmodify

	ldapdelete	ldapmodify
Target	Entire entry by DN	Attributes on an existing DN
Default leaf requirement	Yes	Not applicable
Recursive option	`-r` removes descendants	No equivalent
Dry run	`-n` previews the request	`-n` previews LDIF changes

These client tools cover the normal OpenLDAP administration flow.

Command	One line
ldapsearch	Search and inspect directory entries.
ldapadd	Add entries from LDIF.
ldapmodify	Change attributes with LDIF.
ldapdelete	Remove entries by DN.
ldapwhoami	Confirm the authenticated identity.
slappasswd	Generate password hashes for OpenLDAP.

Browse Linux commands for more command references.

ldapdelete — interview corner

Why does ldapdelete require a leaf entry?

LDAP protects the tree structure by refusing to delete a parent that still has children.

A strong answer is:

“A normal delete removes one leaf DN; I must remove or relocate children first.”

What does ldapdelete -r do?

It searches for and removes all descendants before removing the requested DN. It can destroy a large branch very quickly.

A strong answer is:

“I use -r only for a reviewed, disposable subtree and verify the target DN first.”

Can ldapdelete remove multiple entries?

Yes. Put one DN per line in a file and use -f, or pass multiple quoted DNs as arguments.

A strong answer is:

“A file makes a bulk cleanup reviewable, and -c lets the rest run after a failure.”

When should you use ldapmodify instead?

Use ldapmodify when the identity remains and only an attribute or attribute value should be removed.

A strong answer is:

“ldapdelete removes the DN; ldapmodify changes the contents beneath the DN.”

What does ldapdelete -n accomplish?

It connects and binds like a real run, but prints the intended delete lines instead of sending them.

A strong answer is:

“I pair -n with -v in a change window so reviewers see the exact DNs before I remove -n.”

When does -z matter for recursive deletes?

-r searches for children first. On a large subtree the default size limit can stop the search before every descendant is found.

A strong answer is:

“I list the subtree with ldapsearch first, then raise -z only when the reviewed count exceeds the default limit.”

Troubleshooting

Symptom	Likely cause	Fix
`Operation not allowed on non-leaf (66)`	The DN has child entries	Remove or move children, or review a purposeful `-r`.
`No such object (32)`	DN is wrong or already deleted	Search the expected parent and copy the actual DN.
`Insufficient access (50)`	Bind DN lacks delete ACLs	Use an authorized bind identity or update ACLs in OpenLDAP ACL examples.
`Confidentiality required (13)`	Simple bind was not protected	Add `-ZZ` and correct TLS trust.
`Invalid credentials (49)`	Wrong bind DN or password	Confirm `olcRootDN` or the service account with ldapwhoami.
`Can't contact LDAP server`	Wrong URI, service down, or firewall	Check `-H`, listener address, and `slapd` status.
Bulk file stops at first error	`-c` was omitted	Add `-c` only when later DNs should still be attempted.
Recursive delete left children behind	Size limit truncated the child search	Raise `-z` after counting descendants with `ldapsearch`.

References

OpenLDAP ldapdelete(1) manual{: target="_blank" rel="noopener" }
Manage OpenLDAP users and groups
Install and configure OpenLDAP on RHEL Linux
Configure OpenLDAP TLS on RHEL
OpenLDAP ACL examples

ldapdelete — quick reference

Delete DNs safely

Recursive deletion

Connection and debugging

Help

ldapdelete — command syntax

ldapdelete — command examples

ldapdelete — when to use / when not

ldapdelete vs ldapmodify

Related commands

ldapdelete — interview corner

Troubleshooting

References

Related Articles

Migrate Local Linux Users and Groups to OpenLDAP

ldapadd Command in Linux: Syntax, LDIF & Practical Examples

ldapmodify Command in Linux: Syntax, LDIF Changes & Examples

Search GoLinuxCloud