ok thanks for all, i will investigate this solution.

another similar question, how can I remove "ALL" and "User" from group local admin of the machine? Thanks