A new KB was just released (2834976 ) for Windows Server 2008 R2 running RD Session Host. Where putting the server in Drain Mode causes the removal of the authenticated users group in the Remote Desktop Users group are removed.
“…Consider the following scenario:
- You have the Remote Desktop Services (RDS) role installed on a computer that is running Windows Server 2008 R2.
- You set the user logon mode to drain mode on the computer. For example, you run the following command on the computer:
chglogon /drainIn this scenario, the authenticated users in the Remote Desktop Users group are removed…”