Make sure it is not possible to add system administrator as a group manager