Another bit of maintenance that I like to do is periodically removing unused access groups. I frequently create user-specific groups. When that employee is no longer with the organization, there is no need to keep their access group hanging around. It just clutters up the list of available groups and is one more item you may have to audit.
Fortunately, the query to identify unused groups is very straightforward. All we have to is join over to the 'prsnaccsassign' table, get a count of how many managers are assigned to an access group, and then limit the output to those access groups with a count of 0.
laboracctsetid 'LAS ID',
shortnm 'Mgr Acces Grp Name',
count(personid) 'Count of Mgrs Using'
left outer join
laboracctset.laboracctsetid = prsnaccsassign.mgraccesslasid
labacctsettypeid = 2
count(personid) = 0
Again, just like last time I'm filtering on labor account sets being used as Employee Access Groups (labacctsettypeid = 2). Also, I'm running this across all employees, not just active ones. If an access group is assigned to a terminated associate, it will still get a count and be excluded from this report.
The LORD bless you and keep you; the LORD make his face to shine upon you and be gracious to you; the LORD lift up his countenance upon you and give you peace.
Numbers 6:24-26 (ESV)