Some administrators may choose to delete the predefined ES users after installation, and use only existing Windows user accounts for administering ES and signing on to MSS. We recommend doing this only after verifying basic ES operation with security enabled, since that will make it easier for Support to diagnose any problems.
You should not remove the default user accounts CICSUSER, JESUSER, IMSUSER, and mfuser, unless you specify different default accounts in the ES configuration (see the ES/MSS documentation for details). You can disable these accounts in Windows to prevent anyone from using them to log on to Windows.
If you remove the mf_cs and mf_mdsa users, you will not be able to run nonsecured ES servers using the default options.
Be sure you have another account for MFDS administration before removing the schemaadmin user.
Also, if you used CN=Users as your user container above, you can remove the empty CN=Enterprise Server Users container.