Remove users from some groups but not all

Hi Sander,

This is doable with a scheduled workflow in Active Roles. The trick is that a scheduled workflow starts with no target object, so you drive it yourself:

1. Search activity – scope it to your specific OU and filter for  user  objects. This iterates over every user in that OU and runs the child activities once per user.
2. Script activity (inside the Search activity) – this does the real work: it looks at the user's group memberships and removes only the groups that match your rule.

The most important design decision is how you define "some groups but not all." A scheduled job has no way to guess — you need an explicit rule. Common options:

• Groups whose name matches a pattern (e.g., start with  APP-  or  Temp- ).
• Groups that live in a specific OU/container.
• Groups listed in a config (a Virtual Attribute, a text file, or hard-coded array).

Example script activity (PowerShell / Management Shell style) that removes only groups matching a name prefix:

function onPreExecute($Request)
{
# The user currently being processed by the parent Search activity
$user = $Request.TargetObject

# Define your rule for "some groups": e.g. only APP-* groups
$prefix = "APP-"

# Enumerate the user's direct group memberships
$groups = $user.Get("memberOf")

foreach ($groupDN in @($groups))
{
$group = $Request.GetObjectByDN($groupDN)
if ($group.Name -like "$prefix*")
{
# Remove the user from this group only
$group.Remove("CN=Users,$($user.DN)") # or use RemoveMember
$group.SetInfo()
}
}
}

(Adjust the enumeration/removal calls to your Active Roles version —  Get("memberOf")  +  Group.Remove() / SetInfo()  on the ADSI object, or the ARS  Remove-QADGroupMember  cmdlet if you prefer the Management Shell.)

3. Schedule – on the workflow's start conditions, choose "Run this workflow on a schedule" and set your recurrence (daily/weekly).

A few tips:

• Enumerate  memberOf  and remove based on your rule — never remove all groups; the whole point is the filter decides which ones go.
• Test against a single test user / a lab OU first, and log what would be removed before you actually remove it.
• If your "which groups" list is dynamic, store it in a Virtual Attribute or a small config file so you don't have to edit the workflow to change it.