During installation, if the computer is in a domain, Domain Users will be removed from the local administrator’s group right away. That is all that happens initially.

When a user then logs on, the user will be removed from the local administrator’s group unless:

• You have unchecked “Revoke admins rights” in the portal settings

• The user is in the list of excluded accounts in the portal settings

• The user is member of a group that is the local administrator’s group (such as domain admins)

The reason all users are not just removed right away is to only remove accounts that are actually interactive user accounts and not accidentally remove any service accounts. Please refer to the Windows client technical details page for more information.