what other plugins and their versions do you have installed.

it is likely one of those depends on an old version of Jenkins prior to LDAP being unbundled and as such it is getting reinstalled to satisfy that dependency

ace-editor 1.1 true
active-directory 2.16 true
ant 1.9 true
antisamy-markup-formatter 1.5 true
apache-httpcomponents-client-4-api 4.5.5-3.0 true
authentication-tokens 1.3 true
basic-branch-build-strategies 1.3.2 true
bouncycastle-api 2.17 true
branch-api 2.5.3 true
build-user-vars-plugin 1.5 true
cloudbees-folder 6.9 true
command-launcher 1.3 true
conditional-buildstep 1.3.6 true
copyartifact 1.42.1 true
credentials 2.2.0 true
credentials-binding 1.19 true
display-url-api 2.3.1 true
docker-commons 1.15 true
docker-workflow 1.18 true
durable-task 1.30 true
envinject 2.1.6 true
envinject-api 1.5 true
external-monitor-job 1.7 true
git 3.10.1 true
git-client 2.8.0 true
git-server 1.7 true
gitlab-plugin 1.5.12 true
greenballs 1.15 true
handlebars 1.1.1 true
icon-shim 2.0.3 true
influxdb 1.23 true
jackson2-api 2.9.9.1 true
javadoc 1.5 true
jdk-tool 1.3 true
jquery-detached 1.2.1 true
jsch 0.1.55 true
junit 1.28 true
ldap 1.20 false
lockable-resources 2.5 true
mailer 1.23 true
mapdb-api 1.0.9.0 true
matrix-auth 2.4.2 true
matrix-project 1.14 true
maven-plugin 3.3 true
momentjs 1.1.1 true
pam-auth 1.5.1 true
parameterized-scheduler 0.6.3 true
parameterized-trigger 2.35.2 true
pipeline-build-step 2.9 true
pipeline-graph-analysis 1.10 true
pipeline-input-step 2.10 true
pipeline-milestone-step 1.3.1 true
pipeline-model-api 1.3.9 true
pipeline-model-declarative-agent 1.1.1 true
pipeline-model-definition 1.3.9 true
pipeline-model-extensions 1.3.9 true
pipeline-rest-api 2.11 true
pipeline-stage-step 2.3 true
pipeline-stage-tags-metadata 1.3.9 true
pipeline-stage-view 2.11 true
pipeline-utility-steps 2.3.0 true
plain-credentials 1.5 true
promoted-builds 3.3 true
rebuild 1.31 true
resource-disposer 0.13 true
run-condition 1.2 true
scm-api 2.6.3 true
script-security 1.61 true
sidebar-link 1.11.0 true
ssh-agent 1.17 true
ssh-credentials 1.17.1 true
structs 1.19 true
subversion 2.12.2 true
token-macro 2.8 true
windows-slaves 1.4 true
workflow-aggregator 2.6 true
workflow-api 2.35 true
workflow-basic-steps 2.18 true
workflow-cps 2.72 true
workflow-cps-global-lib 2.14 true
workflow-durable-task-step 2.32 true
workflow-job 2.33 true
workflow-multibranch 2.21 true
workflow-scm-step 2.9 true
workflow-step-api 2.20 true
workflow-support 3.3 true
ws-cleanup 0.37 true

If that were the case (if another plugin depended on it), then (1) given that I have no other installed-but-disabled plugins, I would expect it not to be disableable, and (2) I would hope (but perhaps that’s the subject of this bug report) that it would be reported as not-uninstallable, like other dependencies are.

greenballs is the culprit https://plugins.jenkins.io/greenballs

this behaviour is new as the original issue (which could get you a broken instance) was fixed recently.

the bug here is the UI does not take into account implied plugin dependencies (you should not be able to uninstall them)

Yes, you’re right. Uninstalling green balls allows the other plugins to be uninstalled and they appear to stay gone. I was confused because I thought green balls did not depend on LDAP, because I was able to enable green balls while LDAP was (and remained) disabled. But I guess that is a separate bug (that it is possible to enable a plugin without enabling its dependencies in some cases).