Remove User Groups

Hello All
I just upgraded to BP12 of OIM 9.1.0.2 and in the process, had some problems with the ORM integration where is was creating new copies of roles in OIM for ORM roles. Now, instead of the 30 or so user groups that I should have, I now have about 950 or so. I have fixed the issue with the groups in OIM and change the ORMID of all the groups in OIM so they are no longer linked to ORM, but now I need to remove them so they are not showing up on everyones profiles. Do you know if there is a way to permanently delete user groups and the associated links from OIM so they are not available. Any help you can give on this would be much appreciated.
Thanks
Nick

You can create a list of the groups you want to keep in OIM. Include the 4 default ones. Then looping through the list of groups use something along the lines of the following:
Map map = new HashMap();
map.put("Groups.Group Name", "*");
tcResultSet set = groupIntf.findGroups(map);
long[] users = new long[set.getTotalRowCount]'
for (int i=0;i<set.getTotalRowCount();i++){
set.goToRow(i);
tcResultSet users = groupIntf.getAllMembers(set.getLongValue("Groups.Key");
//Loop through the users result set to get all the Users.Key values. Add them to the array users[].
//After you loop through remove the users
groupIntf.removeMemberUsers(userList);
//After you remove the users, delete the group
groupIntf.deleteGroup(set.getLongValue("Groups.Key"));
I typed this off the top of my head, there is no validation in it. You will be expected to be able to come up with the rest of it in java, but this should give you something to go off of.
-Kevin

Similar Messages

  • Lion upgrade removes user/group for nagios (nrpe)

    FYI:
    Maybe this'll help someone else. I run nrpe/nagios on a couple of my Macs. Upgrading to Lion from SL the upgrade installer removed the user/group for nrpe. On reboot, launchd could not start the process because getpwnam("nagios") failed. The error was repeatedly reported to system.log (Macintosh com.apple.launchd[1] (org.nagios.nrpe[18251]): getpwnam("nagios") failed) causing launchd to use excessive CPU and battery. Recreating the user/group allows the process to start, which allowed launchd to return to normal CPU levels. Also maybe helpful is that when I turned networking off launchd stoped reporting the error which caused the symptoms to stop (which sent me down a fruitless path).
    This error occurred on both a MBP and a Mac Mini. I've reported in via feedback.
    Thanks for listening... Mark

    I have a similar problem - I need to change my account (short) name so that I can backup both my old computer and new computer on timecapsue independently.  However, the link you provided is only for 10.6 and earlier, not for Lion.  Are the instructions for Lion similar?  For one, I have no directory utility on Lion.
    Thanks for your help.

  • Provisionusers.cmd and Migrate users/groups from Planningweb

    Hi
    Is the functionality of Provisionusers.cmd and migrateusers/groups from planning web similar?
    I feel Provsionsuers.cmd is an alternative way to migrateusers/groups from planning web.
    Please correct me if i am wrong.
    Thanks and regards
    krishnatilak

    Hi,
    The provisionusers utility basically syncs planning and essbase with the provisioning of users/groups in shared services.
    If you run the utility and a user exists in shared services but has not been created in the planning database the user will be added.
    If the user does not exist in the essbase security file then they are added.
    If it is a user that exists and has security settings on members in planning then these filters are pushed down to essbase.
    It should also remove users/groups from planning if they have been deprovisioned in shared services.
    Cheers
    John
    http://john-goodwin.blogspot.com/

  • Is there a way in 10.8 Profile Manager to assign certain users the sole right of adding/removing users to user groups?

    Hello,
    I want to assign certain network users the ability to login via browser to the profile manager for 10.8.x server and add/remove other users from user groups.  Think teachers managing their class rosters, if the class was a group and the users their students.  I do not want any other admin funtionality beyond that for them.
    Suggestions?

    Well thank you for being so polite.  Yes, on looking on my 10.8 server, I have the same thing.  How annoying.  I have no idea how to answer your question.  If the management abilities are no longer in Workgroup Manager then there's a change that the server doesn't pay any attention to the settings, so manually changing settings in LDAP won't have any effect either.
    At least I can verify that it's not just you who gets that result.  I wonder what happened and how we're meant to do this now.

  • Removed user from group, user no longer has access to documents even though user is owner of documents

    I'm running a server 2012 std domain and I'm in the process of rebuilding our fileserver after we had some pretty serious permission issues. Bad permissions (Everyone had full access to user documents share) were migrated when we move to the new server and
    then by some strange Monday morning freak out all users lost access to their documents. I restored from backups, redirected everyone's folders back to local computer and started to reconfigure the share permissions. I moved our administration group back to
    the server after securing proper permissions for folder redirection (permissions copied from https://technet.microsoft.com/en-us/library/jj649078.aspx?f=255&MSPPError=-2147217396 table 1, only difference is instead of creating a new security group
    for redirection users, I used the everyone group) to test and everything went perfectly. The GPO created the users folders under the root and redirection was good to go. Along with that, other users cannot access other users documents anymore which was the
    intended outcome. 
    Last night I was looking at security groups and see that our administration group (back office group: accounting, HR, etc..) was a member of the domain admins. I removed them from the domain admins group and added them to the administrators group (they do
    need regular admin access) then went on like normal. This morning, all users in that group can no longer access their documents on the server. I immediately think that permissions were broken again and started to get angry, but then realize that all the files
    are still accessible on the server (no lost permissions like before) and the user is still shown as the owner with full permissions, but the files are inaccessible to those users. I re-added them to the domain admins group, logged out, logged back in and documents
    are back and accessible by the user. Remove them from the domain admins group, log out, log back in and the documents are inaccessible again. Re-add to the domain admins group and back to normal. 
    Which leads me to now. If the users are part of the domain admins group, they have access to their files. If they are removed from the domain admins group, they lose access. When they lose access, they are still the owners of the files/folders with full
    permissions, yet they can't access their documents. Also, just to add, the domain admins group has no specified permissions on the files or folders. See screenshots below..
    Here is the root share. 
    And the user's desktop folder. The folder is owned by the user with full permissions. This is the folder the redirection GPO created.
    Any ideas why removing the group from domain admins would drop access to their files? They are still the owners of the files and should have full access but they don't. Is there something I'm not seeing here?

    Effective Access shows the user has full control of the Desktop folder
    This is a problem with the Effective Access tab when using CREATOR OWNER.  As you have noticed, the user doesn't really have the access that the tab says it does.  This is because of how CREATOR OWNER works.
    CREATOR OWNER is only evaluated when a file/folder is created. 
    IF a user can create a file/folder, then the permissions assigned to CREATOR OWNER are copied to a new permissions entry for that user.
    To see this:
    Logon as an administrator and create a file in the Desktop folder in your screenshot.
    Examine the permissions of the new file.
    You'll see that there is a new entry for the account you logged on with.
    CREATOR OWNER is gone.  CREATOR OWNER would still be there if you created a folder (because of "subfolders and files").
    In the Desktop folder (in your screenshot), only SYSTEM and Administrator can create/access files.
    To fix this, you need to grant the users the ability to list the directory contents and create new files/folders.  This corresponds with the suggestion of Table 1 in the document you found.
    I see what you're saying about Administrators domain group. I'll just add them as local admins via GPO and that should solve that issue. 
    No, scary!  This will grant those users administrative permission on your server.  They will be able to see any file anywhere on that server.
    If your goal is to provide a place that is private for each user, then the simplest approach is to grant each user permission to their own folder.  Like this for Test User:
    Notes for above:
    I set the user's permission to Modify because there is no good reason why the user should change these permissions
    The owner of this folder is unimportant.  I leave it set to Administrators
    You can, and I do, remove CREATOR OWNER.  It adds no value in this situation and just causes confusion.
    As for the second screen shot, the *-Admins folder is the root to which Everyone has special permissions on and can create folders. The folder for M* was created by the GPO, which makes M* the owner to which they have Full control of subfolders and files.
    The GPO also created the Desktop folder, giving owner full permissions of subfolders and files. Inside the Desktop folder, permissions remain Full control for owner for subfolders and files. Even if it was the case that they only had permissions on subfolders
    and files, wouldn't each subfolder under that one be considered a subfolder and file of the top folder?
    If this works as you say, then Yes, it should work.  But, I don't see the entries for use M*.  Remember, there should be entries for the M* user that is a duplicate of CREATOR OWNER.
    I suspect that Group Policy is creating the directories (elevated) and then changing the owner to M* afterward.  This does not duplicate the CREATOR OWNER entries as needed.  If this is the case, I consider it a flaw because your permissions do
    not allow user M* to create files/folders, and group policy shouldn't bypass security.
    I'm not saying your wrong, I'm just curious why the technet article would advise Creator/Owner giving full control of subfolders and files only if that were not correct. I can add the permissions for the users easily, I just don't see why I need to give
    explicit permissions to access something when the GPO created those folders for me, which Microsoft recommends you allow. If the GPO can create folders and the folders are owned by the user, then the user can obviously add/create/modify/view those files and
    folders. 
    When I restored the data, no permission were reset. Permissions were restored to the wonky version where the Everyone group has full access to everything. Ownership of the files/folders remained the same.
    A couple things:
    The article instructed the use of Folder Redirection Users group that had permissions to create files.  Your examples didn't have that.  Because of this, your user could create new files.
    The article assumes that the directories you are creating will be empty.  Existing files will be unreadable to everyone except Admins.
    If you follow the directions in the article, then anyone in the Folder Redirection Users group can write files to anyone else's directory.
    One benefit of the document's approach is that all the users could be redirected to the same folder using the article, and it would work.  A benefit, I guess.
    But, I like my user's separate and unable to see each other's files -- at all.  This is why I recommend replacing CREATOR OWNER with the specific user.
    I believe this document is a "how to get it done" document, not necessarily a best practices document.  I see it as a starting point, and that's why I didn't follow it exactly.
    Lastly, CREATOR OWNER permissions are useful but confusing.  I avoid them unless I have the rare circumstance where they are perfect.
    When I restored the data, no permission were reset. Permissions were restored to the wonky version where the Everyone group has full access to everything. Ownership of the files/folders remained the same.
    To summarize:
    In the user's directory, you need to provide permission to list and create new files/folders, and you need grant the user permission to the existing files.
    -Tony

  • Cannot view the folder security after removed the default "users" group from folder

    Hi guys
    Due to the domain change, I am doing a windows 2003 server migration to windows 2012 for a file server.
    Tones of data have been copied from the old 2003 server to the new setup 2012 server.
    We need remove the "builtin\users" group from the folder security to maintain correct rights access of user to network folder.
    Once the "builtin\users" group has been removed, the account in domain admin group can no longer read the folder security.
    Has anyone faced the similar situation? 
    Or, is there any change in folder security rights of Windows 2012?
    Thanks in advance
    KC@ITL

    Hi,
    Glad to hear that the issue has been resolved.
    If you need any assistance in the future, please do not hesitate to post in our forum.
    Regards,
    Mandy
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • CSSImport Utility - Remove Users from Groups

    We have a security group that has a few hundred users assigned to the group. When there is a need to remove a user from the group it is difficult to find the user as I have comb through the list to find the user i am trying to remove. Two questions: is there a way to sort the users in the group in Share Services? The second question is can users be removed using the CSSImport utility by specifying the "delete" option in the importexport.properties? Does the "delete" option remove the user from the secuity group and or does it delete it completely from ShareServices? (we are using Hyperion v9.3.0.1.0 Build 5)

    Hi,
    I am not so sure about the sorting but removing users from groups can be done with the CSSImportExport utility, I see you are on 9.3.0, try and get hold of the 9.3.1 version as it is backward compatible to the 9.3.0 version and more stable.
    When removing users from groups, just set your import operation to update
    import.operation=update
    and in your import csv just put the group children elements and the users you want in the group.
    #group_children
    id,group_id,group_provider,user_id,user_provider
    TestGroup,,,UserToKeepInGroup,Native Directory
    This way it will keep the users in the import file and remove the users from the group that are not in the file, also it does not remove the user from shared services only from the group.
    Ok?
    Cheers
    John
    http://john-goodwin.blogspot.com/

  • How to Remove User from Built in Administrators group With Group Policy Enabled

    Hi,
    I want to remove user from Administrator group which is in restricted group. So I cannot remove him through Active Directory what is the way to remove user from Administrator restricted group.
    Thanks
    Jibran Ishtiaq

    > Disable Group policy
    "Edit", not "Disable"
    > Under Domain click Delegation and went to the restricted group account.
    > Remove User from group.
    Why "Delegation"? Simply edit the GP object where the "Restricted
    Groups" setting is in place...
    > Also we have two DNS but one from where I remove account is the primary.
    How is DNS related to group policy?
    Martin
    Mal ein
    GUTES Buch über GPOs lesen?
    NO THEY ARE NOT EVIL, if you know what you are doing:
    Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

  • Remove user from multiple Group

    Hi All,
    Can any one help me on this . 
    we have around 100 different  SSLVPN AD security groups. Need a script or command to remove 790 users
    from all these groups.
    we have list of user in excel sheet we want to remove from group only. 
    Regards, Triyambak

    Hi,
    Just checking in to see if the suggestion was helpful. Please let us know if you would like further assistance.
    TechNet Subscriber Support
    If you are
    TechNet Subscription
    user and have any feedback on our support quality, please send your feedback
    here.
    Regards, Yan Li

  • Remove unwanted user, group and ID.

    Can this be posted as a user tip in my name? I am unable to post to user tips.
    After a recent aborted MacPorts install on OS X 10.5.8 I followed MacPorts uninstall instructions at:
    http://guide.macports.org/chunked/installing.macports.uninstalling.html
    The uninstall worked well except that I was left with a user called 'macports' with ID 503 which showed up when adding a user in Get Info or using AppleJack. I was not able to remove this user in System Preferences/Accounts nor add another user with the same name.
    I eventually discovered that this could be resolved by removing the following as root:
    /private/var/db/dslocal/nodes/Default/users/macports.plist
    /private/var/db/dslocal/nodes/Default/groups/macports.plist
    This has removed MacPorts and ID 503 from Get Info and AppleJack and I can now create a new user called MacPorts in System Preferences/Accounts despite the remaining historic entries in /private/var/db/dslocal/indices/Default/index.
    I assume this will work in non-MacPorts situations where the user cannot be removed in System Preferences/Accounts.
    This will probably work in all versions of Leopard and some later OSs.

    Mac OS X 10.7.5 Lion
    1. enable root user       
              click apple(menu)
              ->System Preferences...-> System - Users & Groups
              unlock-> click
                      ->Network Account Server: Join...
              ->Open Directory Utility...
              unlock
              From Directory Utility menu Edit->Enable Root User
    2. switch to root
             su root   
    3. delete files Neville Hillyermentioned
              rm /private/var/db/dslocal/nodes/Default/users/macports.plist
              rm /private/var/db/dslocal/nodes/Default/groups/macports.plist
    4. "disable root user" and "lock" every unlocked menu for safety reason by following step 1

  • Users groups got removed.

    Dear All ,
    In our production system , all the users are removed from the respective Query groups.
    may i know what can be the problem.
    can we get the list of users which were earlier assigned to respective usergroup .
    i mean any table where we can find the old data .

    No we are into 4.6
    even i checked the query area it is standard(client specific).
    how do i know to  which user group, users were assigned earlier .

  • Remove user from multiple groups

    Hello everyone, first time posting here with a question and I apologize if I'm asking in the wrong location.
    To give an idea of what I'm attempting to do, I've recently been developing a vbscript that will take a nightly csv export from my student information system and either create or deactivate student accounts based upon their enrollment status.  I have
    this function working great now, another function I've been developing is to have accounts moved between OU's based upon the school building code assigned to students which I have working as well.  The problem I'm running into right now is having students
    removed from existing active directory groups when they move between OU's.  Essentially what I would like to do is have the script load the users group membership into an array and then remove any groups that end with STUDENTS, below is the code I have
    been working on to accomplish this but have literally hit a brick wall.  If it helps all my student groups for each location runs in this fashion.
    ABCD_STUDENTS
    ABCE_STUDENTS
    Any suggestions would be greatly appreciated.
    ' Student changing OU then we need to update their account to reflect appropriate group memberships.
    Set UserObj = GetObject("WinNT://server.domain.net/" & ADusrname) 'This must be hardcoded to domain controller
    strUserDN = DN
    strUserCN = objuser.cn
    'Add user to the school group if not correct
    Set objGroup = GetObject(varSchoolGroup)
    strUserDN = DN ' Bind to the user object.
    strGroupDN = varSchoolGroup ' Specify group Distinguished Name and check for membership.
    Set objADObject = GetObject("LDAP://"& strUserDN)
    objmemberOf = objadobject.GetEx("memberOf")
    If Not (funIsMember (GetObject("LDAP://" & strUserDN),varSchoolGroup)) Then
    objmemberOf = objadobject.GetEx("memberOf")
    For Each objGroup in objmemberOf
    Set objGroupDelete = GetObject ("LDAP://" & objGroup)
    If Mid(objgroup,7,8) = "STUDENTS" Then
    msgbox "test remove"
    objGroupDelete.PutEx ADS_PROPERTY_DELETE,"member",Array(strUserDN)
    objGroupDelete.setinfo
    subUpdateLogFile studentcounter & " - Removed from student group " & objgroup,student_guid,student_username,student_fullname,"removed group"
    End If
    Next
    'Add user to school group
    Set objGroup = GetObject(varSchoolGroup)
    objGroup.PutEx ADS_PROPERTY_APPEND, "member", Array(struserdn)
    objGroup.SetInfo
    subUpdateLogFile studentcounter & " - Updated school group to " & student_schoolgroup_ldap,student_guid,student_username,student_fullname,"school group"
    objUser.SetInfo
    updated = "yes"
    End If
    Any suggestions would be greatly appreciated.

    With Bill.  This can be done with AD and PowerShell in a couple of lines for reach item.
    You are taking an incorrect approach which is making this much harder than it needs to be.  Your question is also hard to understand.
    Each AD usre object obtained via ADSI will have a list of groups the account is a member of.  You use this to remove the user from the group.  How you choose this is up to you.  You can use an array or a file.  You can also =just use
    OU associated groups.  A user then is added to all or some groups associated with the OU and removed from the groups associated with the OU by just returning the OU associated group list from the OUs.
    Designing AD systems is a specialty.  Once you fully understand the features and capabilities of AD these things are usually simple and painless.  If the design is not done well they are painful and faulty.
    We can answer specific questions.  Understaning the design and capabilities of AD is mostly up to you.
    Start with a tool that is designed to work well with AD like PowerShell. VBScritp is onluy useful to those who are skilled with AD and scripting in VBSdcript.  From your script we can see you are a beginner at both.  As Bill notes...do yourself
    a favor and switch to PowerShell.
    ¯\_(ツ)_/¯

  • How can I remove default auth source prefix that's prepended to user/group name

    Any ideas how I can remove the default auth source prefix that's prepended to user/group name after import? There's a way to do it without going into to config.xml file as we did in admin class but can't remember what was done.
    Thanks
    -Jason

    If it's slow on startup it would be extensions loading or LaunchDaemons starting up. 
    You should have a look in:
    /Library/LaunchDaemons
    /Library/Extensions
    You can count out anything in your home folder and it shouldn't put anything in /System as that's reserved for Apple. 

  • How do I stop iTunes (10.7) from automatically launching upon restart?  "Open at Login" is NOT checked in the dock and I have removed the app from Login Items under Users/Groups.  I am using a MacBook version 10.7.5.  Thank you!

    How do I stop iTunes (10.7) from automatically launching upon restart?  "Open at Login" is NOT checked in the dock and I have removed the app from Login Items under Users/Groups.  I am using a MacBook version 10.7.5.  Thank you!

    Thanks for the response gakker, but I've double-checked the camera / iPhoto / Image Capture scenario, and I'm 100% positive it's got nothing to do with that.
    Plugging in my iPhone has no effect on anything related to this.
    The other thing I should have mentioned is that when iTunes on my Mac is NOT running, then nothing happens on my iPhone screen when I plug it in to my Mac. I only get the "Sync in progress" message when iTunes IS running.
    It's interesting though that you say you also get this "Sync in progress" message, albeit only for a second or two though.
    Can I just double-check something with you however... When you say:
    +"at no time was my iTunes playback interrupted"+
    do you mean the iTunes on your Mac? Because the problem I have is that the iPod-playback on my iPhone is interrupted.
    So can you clarify that for me, please? If you have music playing on your iPhone, and you then plug your iPhone into your Mac when iTunes is running on your Mac, does the music playback on the iPhone get interrupted?

  • On my macbook pro in users & groups how do i remove current user

    my macbook pro in users & groups how do i remove current user

    Welcome to the Apple Support Communities
    To remove an user, just open System Preferences > Users and Groups, select the user you want to delete on the left sidebar, and then, press the - button that it's under the sidebar. Note that you can't delete the user from what you have logged in

Maybe you are looking for

  • How do i get my messages to come up

    i took my sim card out for a week and people having been sending me messages. when i finally put my sim card back in no messages are coming up. can someone help me on how to make them come?

  • Problem on creating process order

    Dear Team, I have a problem on creating process order thru COR1 where the basic start date only accept and follows current date. Basic finished date, no problem. Previously, i can set the basic start date using previous date / date in the past (in th

  • Import cannot be resolved

    Hi All,     Our NWDS always shows that certain import which generated by meta data cannot be found or resolved. For instance "import com.xx.sc_os_sale.dc_ws_styleinfo.comp.wdp.IPrivateStyleInfoComp;" I can find the code file in my local path "D:\Docu

  • How to start a video chatting?

    I'd like to set up a video chat with a relative.  I haven't had any luck. I tried sykpe and iChat.  I cannot find working software for skype. iChat will not accept my aim.com user id.  I get invalid username or password.  I am able to log into aim wi

  • Wi-Fi not working, except for safari.

    I'm having the weirdest problem on my iPod touch 4th gen. In my setting, there is no way to connect to my Wi-fi. for some reason, it stoped working recently because i have been usng it in the past. But! Safari manage to get me connected to internet j