remove duplicate ldap-group from template ('ldap-group' is part of
policy setting and thus provided by caller)