Novell's NDS tree security was laughable as well. It was completely possible to create strange loops with infinite recursion depth, and hidden user objects that the main global admin could not see, let alone remove.
(The basic rules were: Alias objects must point to real objects. At least one user object must be an administrator for any admin other than global admin.)
(as a bored schoolkid, I created an Organizational Unit (OU) object, that contained an alias to itself. This was permitted, and produced an infinitely traversable branch in the tree. This would demolish certain command line tools that did recursive tree navigation. For the user accounts, you can create 2 "Abuser" backdoor accounts, that reference EACH OTHER as admins, but revoke the system admin's permissions to see, touch, or administer them. You can make them into the functional equal of the root global admin, and the global admin will never know, and can never know.)
I made these to see if the system was smart enough to stop you--- *IT WAS NOT*. When I asked the instructor what could be done to correct such situations, I was admonished for creating these conditions in the lab computer network. 🤣