I want to restrict some users from having default privileges of Users group, unless they are manually allowed. Unfortunately, when I remove them from this group manually, they still get Users SID as seen in WHOAMI /ALL: Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545
I don't want to change ACLs, because this action should be part of my program installation, and I don't want my program to change default ACLs across all drives to function.