Today, Remove Admin Privileges demotes the user who signs in to the machine. Other local admin accounts that don't sign in, like leftover setup accounts or former users' profiles, can keep their admin rights. We're adding an option to remove admin rights from all local admin accounts on the endpoint. That closes the gap for machines where standing admin accounts linger unnoticed.