Update Groups & Roles for existing users

Yes, groups and roles can be updated using the loadusers process. Just be aware that both are full replacements, not adds to existing (they have to be full replacements so that you can remove groups or roles that are no longer applicable for the user).

In recent versions of the environment, loadusers was given the ability to append roles to existing roles. The default is still to replace them all, but -a allows you to add to existing Roles (yahoo)!

This is the case in 9017. For earlier versions, run loadusers with no parameters and see if it lists the -a.

usage:  Load Users
        LoadUsers [options]

options:
  -f xmlFileName           XML file that contains data
  -p defaultProductLine    default productline if not set in xml file
  -d defaultDomain         default windows domain, only required for windows
  -u deleteusers           delete roles, groups and users
  -g username              username that was used in the privileged ID
  -a appendroles           append roles to users (default overwrite)
  -?                       print usage

Best regards,
Dave
(303) 773-3535

There is another way without using loadusers, I remember doing it back in 2009.
My notes are old and cryptic, but consider this:
RM Mass Role Assignment
Run Tools, Mass Assignment
Set Criteria
Set Attributes (click on Role)
Start Mass Assignment
Status
(Good luck!)

Thanks, last night i tried out the -a option for Roles and that worked great.
Since it still seams that I can't add to the existing Groups in security for existing users is there an easy way to dump a list of the current groups that I can append to and then use loadusers?

Depends on how much freedom you have with your system, and how good you are at creating ldif files...
We've got a script that re-sets a users group here that I think you could implement... we are using the script to delete one group and add another group to their record after they've been here 30-days. eg. Are no longer considered new hires, we take the new hire link away from them, just by modifying their group memberships.

It uses a combination of sqlplus (Oracle) to identify the employees, and ldapmodify to modify the group memberships.

*Totally not supported!! But it has been working here for years.

Let me know if you'd like more information on it.

Wow that sounds pretty cool unfortunately I don't have that much freedom with our system but thanks.

how about doing a mass assign in RM ? If you need to add group abc and zyx you could query for * with conditions of group <> abc and/or group <> zyx and do the mass assignment from there?