So you migrated from SBS 2003 to SBS 2011 and one of the steps in the migration is to remove any unnecessary security groups… but which ones?
First compare the default security groups as laid down by a default clean install of SBS 2011:
Now compare them to the security groups you get on a migrated server
Mind you I added a few extra for older applications that needed some special registry edits.
Notice how all the new groups now have “Windows SBS” in front?
Can you get rid of all of those legacy groups? Well, did you make any special group policies with them? Take a backup of the server first and then start pruning down to just those security groups you need….which is probably all of the new ones, and then any security group you specifically added.