Description:

This step retrieves the members of an Active Directory group.

The Get AD Group Members workflow step connects to Microsoft Active Directory via a configured LDAP connection and retrieves all user accounts in a specified Active Directory group.

The step supports both direct group membership retrieval and recursive searches. When recursive mode is enabled, users contained within nested groups are also returned.

The retrieved list of members is stored in a FlowWright Variable or a Global Variable, allowing later workflow steps to process, iterate over, validate, or synchronize the membership information.

The step supports:

• Active Directory group membership lookup
• LDAP connection integration
• Recursive nested group expansion
• Dynamic group name lookup using workflow variables
• Storage of retrieved members into workflow variables
• Integration with Active Directory through FlowWright Generic Connections

This step can be used for:

• User provisioning validation
• Identity lifecycle management
• Security auditing
• Group membership reporting
• Access reviews
• Synchronization with external systems
• Business process automation

Usage:

The Get AD Group Members step is typically used whenever a workflow needs to retrieve existing Active Directory group membership before performing additional processing.

The workflow connects to the configured LDAP server and searches for the specified Active Directory group.

If the group is found, FlowWright retrieves all members and stores them in the specified workflow variable.

Later workflow steps can:

• Iterate through group members
• Generate audit reports
• Compare group memberships
• Synchronize users with external applications
• Validate user access
• Send notifications
• Export membership information
• Continue identity management processes

You need to configure an LDAP connection before using this step.

Go to:

Integration → Connections → Generic Connections

On the Manage Generic Connections page, click:

Actions → Create

Configure an Active Directory connection before using this workflow step.

A sample connection is provided here for reference. 

Example:

Let’s build and execute the “clsGetADGroupMembersDef” example:

• Create a new process definition named “clsGetADGroupMembersDef” and open it in designer mode. 
• Drag a “clsGetADGroupMembers” step to the canvas.
• Connect the dots between the “Start” and “clsGetADGroupMembers” steps.
• Configure a variable or global to store the list.
• Click the "clsGetADGroupMembers" step to configure its "Required" properties. Provide a name for the step. Select the LDAP connection from the drop-down list. Provide the Active Directory “Group name”. Provide a variable or global reference to store the list of members. Click the Save button to confirm. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• Click the "clsGetADGroupMembers" step to configure its "Optional" properties. Select “Yes” if parent-child groups are configured. Click the Save button.  

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown in the images below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Get AD Group Members step, FlowWright connects to the configured LDAP server and searches for the specified Active Directory group. 

• Click the process step to view its properties. If the group is found, the members are retrieved and stored in the configured output variable, and the workflow follows the True return path. If the group cannot be found, the LDAP connection fails, or the query cannot be completed, the workflow follows the False return path.

Tips:

• Verify that the LDAP connection has been configured before using this step.
• Use workflow variables to dynamically populate the group name.
• Enable Recursive when nested group memberships should be included.
• Use a Variable or Global Variable capable of storing multiple returned values.
• Verify that the specified group exists before executing the workflow.
• Ensure the LDAP account has permission to read group membership.
• Use the True and False return paths to implement appropriate success and error handling.
• Combine this step with the Create User, Add User To Group, Remove User From Group, or Update User Attributes steps to automate the complete Active Directory lifecycle.

Notes:

• A valid LDAP connection must exist before this step can execute.
• The configured connection must have sufficient permissions to read Active Directory objects.
• The specified Active Directory group must already exist.
• Recursive searches may increase execution time in environments with deeply nested groups.
• Large groups may return a significant number of users depending on directory size.
• Network connectivity or authentication issues may prevent successful retrieval.
• The workflow should include appropriate error handling for the False return path.
• The retrieved members are written to the configured workflow Variable or Global Variable for use by subsequent workflow steps.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them (drag-and-drop) into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• LDAP connection
• Active Directory server configuration
• Group name mapping
• Output variable mapping
• Workflow variable mappings
• Active Directory permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.