Description:

This step deletes an existing Active Directory group.

The Delete Active Directory Group workflow step connects to Microsoft Active Directory via a configured LDAP connection and permanently deletes the specified Active Directory group.

The step identifies the group by the specified group name and removes it from the directory. Once deleted, the group can no longer be used for access control, security assignments, or distribution purposes unless it is recreated.

This step provides an efficient way to automate group decommissioning as part of application retirement, project completion, department restructuring, security cleanup, or identity lifecycle workflows.

The step supports:

• Active Directory group management
• Deletion of existing Active Directory groups
• Configurable LDAP connections
• Dynamic group name input using workflow variables
• Integration with Microsoft Active Directory

This step can be used for:

• Project or application decommissioning
• Department restructuring
• Security group cleanup
• Identity lifecycle management
• Directory maintenance
• Access management
• Business process automation

Usage:

The Delete Active Directory Group step is typically placed after an approval, decommissioning, or cleanup process within a workflow.

The workflow deletes the specified Active Directory group using the configured LDAP connection.

A typical workflow might look like this:

Once the group has been deleted, later workflow steps can:

• Generate audit reports
• Notify administrators
• Synchronize identity systems
• Remove references from downstream applications
• Update configuration repositories
• Continue identity lifecycle management processes

You need to set up an LDAP connection before using this step.

Go to:

Integration → Connections → Generic Connections

On the Manage Generic Connections page, click:

Actions → Create

Configure an Active Directory connection before using this workflow step.

A sample connection is provided here for reference. 

Example:

Let’s build and execute the “clsDeleteADGroupDef” example:

• Create a new process definition named “clsDeleteADGroupDef” and open it in designer mode. 
• Drag a “clsDeleteADGroup” step to the canvas.
• Connect the dots between the “Start” and “clsDeleteADGroup” steps.
• Click the "clsDeleteADGroup" step to configure its "Required" properties. Provide a name for the step. Select the LDAP connection from the drop-down list. Enter the “Group Name”. Click the Save button to confirm. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown in the images below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Delete Group step, FlowWright connects to the configured Active Directory server using the selected LDAP connection and attempts to delete the specified Active Directory group. If the operation completes successfully, the workflow follows the Deleted return path. If the specified group cannot be found, is protected from deletion, is currently in use, or the LDAP connection cannot be established, the workflow follows the NotDeleted return path.

• Click the process step to view its properties. The step should delete the specified Active Directory group and return Deleted upon successful completion. Use the List All Groups or Read Group workflow step, if available, to verify that the group has been removed from Active Directory.

Tips:

• Verify that the LDAP connection has been configured before using this step.
• Ensure that the LDAP account has permission to delete Active Directory group objects.
• Verify that the specified group exists before attempting to delete it.
• Use workflow variables to dynamically provide the group name.
• Consider validating that the group is no longer required before deleting it.
• Use the Deleted and NotDeleted return paths to implement appropriate success and error handling.
• Combine this step with Remove Users from Group, List All Groups, Create Group, or Read Group steps to automate complete Active Directory group lifecycle management workflows.

Notes:

• A valid LDAP connection must exist before this step can execute.
• The configured LDAP account must have sufficient permissions to delete Active Directory group objects.
• The specified Active Directory group must already exist.
• Deleting a group permanently removes the directory object and its associated memberships.
• Applications or workflows that depend on the deleted group may require additional updates.
• Network connectivity or authentication issues may prevent the group from being deleted.
• The workflow should include appropriate error handling for the NotDeleted return path.
• The workflow result depends on the current state of the Active Directory group and the permissions granted to the configured LDAP connection.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them (drag-and-drop) into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• LDAP connection
• Group name mapping
• Workflow variable mappings
• Active Directory permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.