A managed Endpoint Protection client will not change group or domain membership after some operations