That reminds me of something else that I wanted to note / add as a ticket.  I'm concerned that a user could accidentally smoke users out of, for instance, their `Administrators` group.  I think @ferventcoder had mentioned a `noclobber` or similar property.  I think that should go in a new ticket, as you could accidentally shoot yourself in the foot badly if users are removed from a group that you weren't even aware that were there.