migrate sysadmin group from template to attribtues [COOK-4014]

with this, it's possible to deactivate the sysadmin group if case
it's not needed/present.