The https://www.virtualmin.com/node/53058 pages mentions about this new feature:
Unexpected server processes running as domain users are now detected and included in the validation report, and can optionally be automatically terminated.
but I couldn't find any documentation or discussion on this new feature and wonder:
1) What were the basis for introducing this kind of feature? Are they (unexpected server processes running as domain users) happen so often? Why they happen at all?
2) What are exact steps to configure this new feature to terminate such unexpected process automatically?