Prevent a group from being copied.

Question

When copying an account is there a way to prevent a specific group from being copied? This group requires approval so we wouldn't want a new account to be added during the provisioning step.

JohnnyQuest · Accepted Answer

In an ARS-managed environment, the old practice of copying accounts should really be un-necessary as through its user and group provisioning policies, ARS gives you the ability to control the automated placement of users into their required groups. 
 To directly answer your question, you could actually use a group membership auto provisioning policy to automatically pull users out of the group when they are created in a particular OU. The policies work both ways and you can set criteria that determine when someone should be removed from a group. 
 The attached PDF shows the steps for creating a policy that will remove a user from a list of sensitive groups when they are created in a particular OU. This policy would then need to be linked to the OUs where you create users. 
 Group_Removal_Policy_Sample.pdf

Aidar.Karabalaev · Answer

#1. ARS OOB User Provision Policies (Automated Group Membership, Dynamic Groups, Workflows on Demand) can be utilized for user provision to existing groups without group copy. 
#2. ARS Group Family feature might be useful for automated DL generation (per Office Location, for example) – it will create new Groups for ne Office Locations 
#3. ARS Permissions/Roles been designed correctly may provide Not Allow Group-Copy Right (or DENY explicitly Group-Copy rights) against certain OUs (Groups)