Have configured All available LUM service types for my OES11 servers on install and have then created groups that are LUM enabled for different users sets, some can ssh and FTP, others can only FTP.

However it seems that having granted a number of LUM enabled services to a group of users makes it impossible to remove Them again. for One group i removed the ssh service on the group object - but the users still had ssh access.

Am I missing some cleanup operation here ? - servers have been restarted and i have also tried to reenable LUM for the group, but the original service allowance seems to stick somehow.

What is missing here ?