Technical Tip: How to troubleshoot issues when trying to delete unused address objects in FortiManager

1. The user may come across the following error message/pop-up when attempting to delete firewall objects from FortiManager, even when the firewall object is not used or referenced.

FortiManager error message: 'Failed to delete objects due to following reason: used - object is copied to vdom [vdom name]'.

2. This scenario generally happens because there was a per-device mapping previously set for the firewall object. Below is a sample CLI output that shows the per-device mapping for the user group firewall object.

execute fmpolicy print-adom-object <adom> <category> <object name>

FMG # execute fmpolicy print-adom-object 3 152 user-group1
Dump object [user-group1] of category [user group] in adom [root]:
---------------
config user group
edit " user-group1"
set _scope "FGT"-"VDOM "
next

3. The workaround is to create a script in FortiManager while setting the script to run on 'Policy Package or ADOM Database' to delete the per-device mapping for the affected firewall object.

Below is a sample of the script to delete the per-device mapping for the user group firewall object:

config user group
    edit " user-group1"
        unset _scope 
    next

end

4. Once the script has been executed successfully, the user should be able to delete the firewall object.