Notes

There are also a series of built-in groups thatare used to determine the extent a user account can access the system:

Access Control Assistance Operators: These users query attributes on a file and security permissions, but not set them.
Administrators: The group of people with unfettered and complete access.
Backup Operators: Only people in this group can run a backup job, or restore from a backup.
Cryptographic Operators: Only these people can edit, use, or create a certificate.
Distributed COM Users: Only this group can launch COM objects on the system.
Event Log Readers: Only this group can read the event logs.
Guests: These have the same access rights as the standard users in the Members group. There are slightly tighter restrictions, but the fact that the person is not named in the Event Log is enough to justify that you should never use the Guest account as you do now know the real identity of the person accessing your network. It is more preferable to add a specific account for the guest with their actual name and then lock it down by adding it to an Organizational Unit.
Hyper-V Administrators: Only people in this group can create Virtual Machines, delete them, or reconfigure them.
IIS-IUSRS: The IIS (Web Hosting) service uses this group to identify users who can access IISwebsites.
Network Configuration Operators: These can make changes to IP addresses assigned to network devices.
Performance Log Users: These users can start logging specific logs.
Performance Monitor Users: Once created, these users can read performance counters that have been previously saved. This applies to the local system and also other PCs on the network.
Power Users: A half-way house between a standard user and an Administrator, this level has limited access to higher functions on the PC.
Remote Desktop Users: These users can log on remotely and use the Remote Desktop App.
Remote Management Users: Only these users can issue Remote Management commands, such as PowerShell commands issued against other PCs.
Replicator: These users can copy files across the Domain.
Users: This is the typical User group where standard users are stored.
HomeUsers: These users are part of the HomeUsers security group.
WinRMRemoteWMIUsers: These users can use the Windows Management Instrumentation protocol to determine if a PC is of a certain type of hardware, or OS (for example, laptop running Windows 8.1) and use this information to determine if a policy should be applied.