Recently, my client's Windows Server 2008 R2 was hacked, and the Guest account is added into local Administrators group. The default Administrator account hasn't changed or renamed.
When I try to remove the Guest account from local Administrators group, I got the error message: "Cannot perform this operation on built in account", the error code is 1371(ERROR_SPECIAL_ACCOUNT).
I have disabled the Guest account, but it's better remove it from local Administrators group. I can't find answer about this issue on net, so it will be appreciated if anyone could help on this issue.