Manage TFS 2010 Default Groups

I had the need this morning to remove some mystery users from our TFS 2010 Project Collection Server Accounts group.  Unfortunately, the TFS admin UI prevents you from doing this since the group should not be self managed.  This can be done, but from the command line:

Remove User:
tfssecurity /g- "Project Collection Service Accounts" n:domain\user /collection:https://tfs.domain.com/tfs/collectionname

Add User:
tfssecurity /g+ "Project Collection Service Accounts" n:domain\user /collection:https://tfs.domain.com/tfs/collectionname