What is the value of the hasSubordinates attribute is for some entries
that you can't delete? For some reason, most (but not all!) of my
ou=people entries report hasSubordinates=TRUE, though of course none of
them actually do have subordinates.
I notice the wording of one of the x500 specs as saying that
hasSubordinates=TRUE means that an entry "may" have subordinates. I don't
know whether that means the entry is allowed to have subordinates (but
doesn't LDAP allow all entries to have subordinates?) or whether it is
possible that the entry has subordinates and so further checks should be
performed to be sure? I don't know enough about how LDAP schema work to
be able to contribute meaningfully in this area...