Attempting to use the Group Management pre-configuration template to Modify the local Users group to Remove both the INTERACTIVE and Authenticated Users from membership, but it fails.   I can successfully do this for Domain users and groups.

 

Execution fails with the error "A member could not be added to or removed from the local group because the member does not exist".

 

I noticed that, in DC, when I view the computer's System tab, select Groups then click Users, that neither the Interactive or Authenticated Users show to exist, but they do exist when viewing through Computer Management on the local system.  Same goes for local users listing in DC, they do not show up.

 

I've tried combinations of the member name as with Local User or Domain Group specified:

   interactive

   INTERACTIVE

   NT AUTHORITY\INTERACTIVE

   nt authority\interactive

   "nt authority\interactive"

   "NT AUTHORITY\INTERACTIVE"

   intractive (S-1-5-4)

   nt authority\interactive (S-1-5-4)

   "nt authority\interactive (S-1-5-4)"

   "NT AUTHORITY\INTERACTIVE (S-1-5-4)"

 

from any system, if I run the command line " net localgroup users interactive /delete" and the account is removed.  Does the DC support removing these 'built-in' accounts (actually groups) from local group membership (if not, it really should as it can be a serious problem  where you do not want every authenticated user in the domain to logon to any or all systems).