diff --git a/pro/logic/user_mgmt.go b/pro/logic/user_mgmt.go
index 9056b655..0042f7cd 100644
--- a/pro/logic/user_mgmt.go
+++ b/pro/logic/user_mgmt.go
@@ -1090,7 +1090,9 @@ func EnsureDefaultUserGroupNetworkPolicies(old, new *schema.UserGroup, migrate b
 
 	policyEnabled := make(map[schema.NetworkID]bool)
 	defaultAclName := GetDefaultGroupAclName(groupName)
-	if migrate {
+	if migrate &&
+		groupID != GetDefaultGlobalAdminGroupID().String() &&
+		groupID != GetDefaultGlobalUserGroupID().String() {
 		acls := logic.ListAcls()
 		for _, acl := range acls {
 			if acl.Default {