Description:

This step removes an Active Directory user from multiple Active Directory groups.

The Remove Active Directory User From Groups workflow step connects to Microsoft Active Directory through a configured LDAP connection and removes an existing user from one or more specified Active Directory groups.

The step accepts a keyword list of group names, allowing a single user to be removed from multiple groups during a single workflow operation. Group names can be entered manually or supplied dynamically using FlowWright workflow variables.

The step supports:

• Active Directory group membership management
• Removing a user from multiple groups in a single operation
• Configurable LDAP connections
• Keyword list input for group names
• Integration with Microsoft Active Directory

This step can be used for:

• Employee offboarding
• Department transfers
• Role and permission changes
• Security access reviews
• Identity lifecycle management
• Active Directory administration
• Business process automation

Usage:

The Remove Active Directory User From Groups step is typically placed after an approval or identity management process within a workflow.

The workflow removes the specified user from each configured Active Directory group using the selected LDAP connection.

Once the user has been removed from the groups, later workflow steps can:

• Disable the user account
• Archive user access
• Synchronize identity systems
• Notify administrators
• Generate audit reports
• Continue identity lifecycle management processes

You need to set up an LDAP connection before using this step.

Go to:

Integration → Connections → LDAP Connections

On the Manage LDAP Connections page, click:

Actions → Create

Configure an Active Directory connection before using this workflow step.

Example:

Let’s build and execute the “clsRemoveADUserFromGroupsDef” example:

• Create a new process definition named “clsRemoveADUserFromGroupsDef” and open it in designer mode. 
• Drag a “clsRemoveADUserFromGroups” step to the canvas.
• Connect the dots between the “Start” and “clsRemoveADUserFromGroups” steps.
• Click the "clsRemoveADUserFromGroups" step to configure its "Required" properties. Provide a name for the step. Select the LDAP connection from the drop-down list. Provide the “User name”. Click the button to configure Active Directory group names. Click the Save button to confirm. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• Click the button to configure the Active Directory group name. A pop-up is displayed for configuration. Click the Add Row (+) button to insert an empty row. Provide the group name. Click the Save button. You can map multiple group names by using the Add Row function.  

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown in the images below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Remove User From Groups step, FlowWright connects to the configured Active Directory server using the selected LDAP connection and attempts to remove the specified user from all configured groups. If the user is successfully removed from every specified group, the workflow follows the Removed return path. If one or more groups cannot be processed—for example, because a group does not exist, the user cannot be found, the user is not a member of one or more groups, or the LDAP connection cannot be established—the workflow follows the NotRemoved return path. Use the Get Active Directory User Groups step to verify the user's remaining group memberships after execution.

• Click the process step to view its properties. The step should remove the user from the Active Directory and return “Removed” on completion. Use the “clsGetADGroupMembers” process step in the workflow to verify the updates. 

Tips:

• Verify that the LDAP connection has been configured before using this step.
• Use workflow variables to dynamically populate the username and group list.
• Verify that each specified group exists before attempting removal.
• Ensure that the specified user already exists in Active Directory.
• Use the keyword list editor to simplify managing multiple group names.
• Use the Removed and NotRemoved return paths to implement appropriate success and error handling.
• Combine this step with Disable Active Directory User, Delete Active Directory User, or Unlock Active Directory User steps to automate the complete identity lifecycle.

Notes:

• A valid LDAP connection must exist before this step can execute.
• The configured LDAP account must have sufficient permissions to modify Active Directory group memberships.
• The specified user account and groups must already exist in Active Directory.
• Attempting to remove a user from a group where they are not a member may not result in any changes.
• Network connectivity or authentication issues may prevent successful updates to group memberships.
• The workflow should include appropriate error handling for the NotRemoved return path.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them (drag-and-drop) into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• LDAP connection
• Username mapping
• Group list mappings
• Workflow variable mappings
• Active Directory permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.