I was looking a the SIDs in my domain and came across a group with the name WinRMRemoteWMIUsers__ (two underscores) with a RID of 1000 under the domain SID. I'd been under the impression that SIDs with a RID of 1000 or greater were created by the user and not Windows, and started searching around.
This Windows Server 2012 specific article describes a group WinRMRemoteWMIUsers_ (one underscore). In that article it has the well-defined RID of 1000 under a domain SID (so it's clear 1000 isn't the lower limit).
In this more general article, there is the same group WinRMRemoteWMIUsers_ with one underscore. But this time it says the RID is variable.
The name WinRMRemoteWMIUsers__ with two underscores appears in notes in the group's description in both articles.
Is this really two separate groups or just a typesetting issue?
(The actual function of the group(s) isn't really important to this question, unless it explains why there would be two groups).
