---
title: Converting static groups to inverted static groups
description: Convert a traditional static group to an inverted static group to improve performance for groups with large member lists.
component: pingdirectory
version: 11.1
page_id: pingdirectory:pingdirectory_server_administration_guide:pd_ds_inverted_static_groups_convert
canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_inverted_static_groups_convert.html
llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-08-17T00:00:00Z
section_ids:
  before-you-begin: Before you begin
  steps: Steps
  example: Example:
  example-2: Example:
  example-3: Example:
  example-4: Example:
  example-5: Example:
  example-6: Example:
  example-7: Example:
  next-steps: Next steps
---

# Converting static groups to inverted static groups

You can convert a traditional static group to an inverted static group to improve performance for groups with large member lists.

|   |                                                                                                                                                                                                                        |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | Converting a group is not an atomic operation. Clients that rely on the group will experience a brief disruption between the time the traditional static group is deleted and the time all member entries are updated. |

## Before you begin

Before converting a group, identify any member entries that are groups rather than users. The inverted static group referential integrity plugin prevents adding group entries as direct members of an inverted static group. Add those entries as nested groups using `ds-nested-group-dn` instead.

## Steps

1. Search for the traditional static group to retrieve its full member list. Groups with the `groupOfNames` or `groupOfEntries` object class store members in the `member` attribute, while groups with the `groupOfUniqueNames` object class use the `uniqueMember` attribute instead. Request both attributes so that the search returns the correct member list regardless of the group's object class.

   ### Example:

   ```shell
   $ bin/ldapsearch --baseDN "<group_DN>" --searchScope base "(objectClass=*)" member uniqueMember
   ```

2. Review the list of members and identify any entries that are groups. Add those entries as nested groups (in step 6) rather than as direct members.

3. Delete the traditional static group entry.

   ### Example:

   ```
   dn: <group_DN>
   changetype: delete
   ```

   Save this LDIF content to a file, then use the `ldapmodify` tool to apply it:

   ```shell
   $ bin/ldapmodify --filename delete-group.ldif
   ```

4. Add a new inverted static group at the same DN.

   ### Example:

   ```
   dn: <group_DN>
   changetype: add
   objectClass: top
   objectClass: ds-inverted-static-group
   cn: <group_cn>
   ```

   ```shell
   $ bin/ldapmodify --filename add-inverted-group.ldif
   ```

5. For each user member, update the user entry to add the group DN to the `ds-member-of-inverted-static-group-dn` attribute.

   ### Example:

   ```
   dn: <user_DN>
   changetype: modify
   add: ds-member-of-inverted-static-group-dn
   ds-member-of-inverted-static-group-dn: <group_DN>
   ```

   ```shell
   $ bin/ldapmodify --filename add-members.ldif
   ```

6. For each group member identified in step 2, update the inverted static group entry to add the nested group's DN to the `ds-nested-group-dn` attribute. If the group has multiple nested groups, you can add all of their DNs in a single modification by providing multiple values for `ds-nested-group-dn`.

   ### Example:

   ```
   dn: <group_DN>
   changetype: modify
   add: ds-nested-group-dn
   ds-nested-group-dn: <nested_group_DN>
   ds-nested-group-dn: <additional_nested_group_DN>
   ```

   ```shell
   $ bin/ldapmodify --filename add-nested-groups.ldif
   ```

7. Verify that the server considers the expected users as members of the inverted static group, using the `isMemberOf` virtual attribute.

   * Check a single member's entry.

     ### Example:

     ```shell
     $ bin/ldapsearch --baseDN "<user_DN>" --searchScope base "(objectClass=*)" isMemberOf
     ```

   * Search for all expected members at once, using a base DN that's higher in the DIT than all of the member entries.

     ### Example:

     ```shell
     $ bin/ldapsearch --baseDN "<search_base_DN>" --searchScope sub "(isMemberOf=<group_DN>)"
     ```

## Next steps

If any application that uses the group expects traditional static group behavior, enable the Traditional Static Group Support for Inverted Static Groups plugin. Learn more in [Using inverted static groups with applications](pd_ds_inverted_static_groups_apps.html).