Description:

This step removes multiple users from an Active Directory group.

The Remove Active Directory Users From Group workflow step connects to Microsoft Active Directory through a configured LDAP connection and removes one or more existing users from a specified Active Directory group.

The step accepts a list of usernames, allowing multiple users to be removed from the same group in a single workflow operation. Usernames can be entered manually or supplied dynamically using FlowWright workflow variables.

The step supports:

• Active Directory group membership management
• Removing multiple users in a single operation
• Configurable LDAP connections
• Keyword list input for usernames
• Integration with Microsoft Active Directory

This step can be used for:

• Employee offboarding
• Department transfers
• Project completion
• Role and permission changes
• Security group administration
• Identity lifecycle management
• Business process automation

Usage:

The Remove Active Directory Users From Group step is typically placed after an approval or identity management process within a workflow.

The workflow removes the specified users from the selected Active Directory group using the configured LDAP connection.

Once the users have been removed, later workflow steps can:

• Update user permissions
• Synchronize identity systems
• Notify administrators
• Generate audit reports
• Continue identity lifecycle management processes
• Complete employee offboarding activities

You need to set up an LDAP connection before using this step.

Go to:

Integration → Connections → LDAP Connections

On the Manage LDAP Connections page, click:

Actions → Create

Configure an Active Directory connection before using this workflow step.

Example:

Let’s build and execute the “clsRemoveADUsersFromGroupDef” example:

• Create a new process definition named “clsRemoveADUsersFromGroupDef” and open it in designer mode. 
• Drag a “clsRemoveADUsersFromGroup” step to the canvas.
• Connect the dots between the “Start” and “clsRemoveADUsersFromGroup” steps.
• Click the "clsRemoveADUsersFromGroup" step to configure its "Required" properties. Provide a name for the step. Select the LDAP connection from the drop-down list. Provide the Active Directory “Group name”. Click the button to configure multiple user names. Click the Save button to confirm. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• Click the button to configure multiple user names. A pop-up is displayed for configuration. Click the Add Row (+) button to insert an empty row. Provide the “user name”. Click the Save button. You can prove multiple “user names” by using the Add Row function.  

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown in the images below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Remove Users From Group step, FlowWright connects to the configured Active Directory server using the selected LDAP connection and attempts to remove all specified users from the selected group. If all users are successfully removed, the workflow follows the Removed return path. If one or more users cannot be removed—for example, because the group does not exist, a user cannot be found, the user is not a member of the group, or the LDAP connection cannot be established—the workflow follows the NotRemoved return path.

• Click the process step to view its properties. The step should remove multiple users from the Active Directory group and return “Removed” on completion. Use the “clsGetADGroupMembers” process step in the workflow to verify the updates. 

Tips:

• Verify that the LDAP connection has been configured before using this step.
• Use workflow variables to dynamically populate the group name and user list.
• Verify that the specified group exists before attempting to remove users.
• Ensure that each username already exists in Active Directory.
• Use the keyword list editor to simplify managing multiple usernames.
• Use the Removed and NotRemoved return paths to implement appropriate success and error handling.
• Combine this step with Disable Active Directory User, Unlock Active Directory User, or other Active Directory workflow steps to automate the complete identity lifecycle.

Notes:

• A valid LDAP connection must exist before this step can execute.
• The configured LDAP account must have sufficient permissions to modify Active Directory group memberships.
• The specified group and user accounts must already exist in Active Directory.
• Attempting to remove a user who is not currently a member of the specified group may not result in any changes.
• Network connectivity or authentication issues may prevent successful updates to group memberships.
• The workflow should include appropriate error handling for the NotRemoved return path.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them (drag-and-drop) into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• LDAP connection
• Group name mapping
• User list mappings
• Workflow variable mappings
• Active Directory permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.