The LDAP group sync now removes users from a group.