clean up groups and permissions