Some applications perform non-standard admin checks such as calling GetTokenInformation to retrieve TokenGroups then compare ...

Some applications perform non-standard admin checks such as calling GetTokenInformation to retrieve TokenGroups then compare the group SID with S-1-5-32-544. This will generate false positive for Protected Admins since they have that SID, although deny-only. This shim is intended to fix such problems.