USMT ChangeGroup command to remove users from the Administrators group is not working

Question

I'm running USMT in a task sequence, and using this in my config.xml to remove admin rights:
  <ProfileControl>
    <localGroups>
      <mappings>
        <changeGroup from="Administrators" to="Users" appliesTo="AllUsers">
          <include>
            <pattern>*</pattern>
          </include>
        </changeGroup>
      </mappings>
    </localGroups>
  </ProfileControl>
I see in the scanstate log that this happens: 
[0x000000] ProfileControl: Parsing ChangeGroup Administrators => Users for AllUsers
[0x000000] ProfileControl: Parsing ChangeGroup (Administrators => Users) 1 include nodes
[0x000000] ProfileControl: Parsing ChangeGroup (Administrators => Users) 0 exclude nodes
[0x000000] ProfileControl: Parsing ChangeGroup is done
But, in the loadstate on the other end, this happens:
[0x000000] Local Group Membership Mapping: XYX\User123 Added to Administrators
I've tried USMT 4 and 5, changed appliesTo="AllUsers" to "MigratedUsers", i've made the <include> more specific.  I can see in the C:\_SMSTaskSequence folder that the config.xml does have the correct info in it. 
I thought I had this tested and working previously, and noticed in some recent migrations that the user still had admin rights. I can reproduce the issue on demand now.  I recently upgraded sccm 2012 to r2, but I'm not sure what that would have to do
with the issue. I am not using the USMT 6 package (going from XP still).  It may very well be that my testing was flawed, and I didnt have it working in the first place
Any suggestions are welcome.

Answer 1

you bet, it is a vbs:
Dim network, group, user
Set network = CreateObject("WScript.Network")
Set group = GetObject("WinNT://" & network.ComputerName & "/Administrators,group")
For Each user In group.members
If UCase(user.name) <> "ADMINISTRATOR" And UCase(user.name) <> "DOMAIN ADMINS" And UCase(user.name) <> "SYSTEM WORKSTATION (ADMINISTRATOR)" Then
group.remove user.adspath
End If
Next
Obviously you can modify the list of allowed admin accounts to suit your enviornment.