Unexpected behaviours with OmeSiteAdministrators Role

I am currently working on testing the functionality of the OmeSiteAdministrator Role so we can use it in our organization.  We are running OME 2.0.0.1926.

I went into Preferences - Device Group Permissions and added a new test user (Using the edit members of OmeSiteAdministrators common task.)  I provided the correct domain and user name.  Then I went to the Manage Device Group Permissions section and selected one group that this user should be able to deploy updates and remote tasks to.

When logging into the Console as this test user I was able to see ALL devices in Manage - Devices.  When I went to Manage - System Update I was also able to see all devices in the uncompliant section and was able to select any device to bring up the System Update Task window for.

I looked at the test user's Roles (clicking on the user name in the top right corner) and saw he was an OmeSiteAdministrator and OmeUser.  It looks like a clean install of OME adds the group BUILTIN\Users to the OmeUsers group.  I removed BUILTIN\Users from the OmeUsers group and then the test user could only see members of the one specified group in Manage - System Update.

But When the test user next launched the OME console, they still could see ALL devices in Manage - System Update, even though the top of the window says "System Update: Filter by: <group name>.  The specified group actually only contains one device, but the test user can see all devices.

I logged in as an OmeAdministrator, looked back at Device Group Permissions, and see an additional user.
In Edit Members of OmeSiteAdministrators I see the test user listed twice, both times with the correct domain and user name.  But under Manage Device Group Permissions, there is the user DOMAIN/user that I added, but now also an UNKNOWN/user (domain is actually "UNKNOWN" and user is the test user name.)

It looks like the Filter does not always work (It only worked once for the test user.  Every other time the test user opens the console it has shown all devices.)  Also, Im not sure why there is the addition of the UNKNOWN/username user.