diff --git a/modules/blocks/lldap.nix b/modules/blocks/lldap.nix
index 9d66a6d..807e2a5 100644
--- a/modules/blocks/lldap.nix
+++ b/modules/blocks/lldap.nix
@@ -331,7 +331,7 @@ in
     enforceGroups = mkOption {
       description = "Remove groups not set declaratively.";
       type = types.bool;
-      default = true;
+      default = false;
     };
 
     dashboard = lib.mkOption {
diff --git a/modules/blocks/lldap/docs/default.md b/modules/blocks/lldap/docs/default.md
index c0b9755..3353f79 100644
--- a/modules/blocks/lldap/docs/default.md
+++ b/modules/blocks/lldap/docs/default.md
@@ -83,7 +83,7 @@ Also, all other groups will be deleted and only the "family" group will remain.
 Note that the `lldap_admin`, `lldap_password_manager` and `lldap_strict_readonly` groups, which are internal to LLDAP, will always exist.
 
 If you want existing groups not declared in the `shb.lldap.ensureGroups` to be deleted,
-set [`shb.lldap.enforceGroups`](#blocks-lldap-options-shb.lldap.enforceGroups) to `false`.
+set [`shb.lldap.enforceGroups`](#blocks-lldap-options-shb.lldap.enforceGroups) to `true`.
 
 ```nix
 {