ensure users are removed before groups