Why are some groups in "groups" and some in "builtin"?

can I move all of the default groups (and users) to → builtin?
what’s the reason to have some of them in the groups/users folder.
for example: “Read-only Domain Controllers” (Group)

Builtin are Microsoft AD builtin accounts - you only get them with SAMBA installed

why would you move them - what should be the goal of moving ?


I don’t want to move users out of “builtin” but some grousp like “Read-only Domain Controllers” in there. this way I can deny access to “bultin” and with some other steps get multi-tenancy.

denying read-access to users / groups is not possible because it kills UMC (and most likely other functionality)