I created a user account with setup/newuser, it originally listed me as a member of domain users twice. One of the two entires wouldn't delete because it was my primary group membership, but the other one did (deleted through dsa.msc while logged in as administrator)
Yeah, it is bogus to manually add to the group. I'll fix up the scripts when I get a moment to convert the to the new python code.
This seems a bit similar to my problem (#4845).
This should be fixed.