best way to set local admins
I've noticed that all our PCs have a default list of local administrators.
This has been done via group policy: the GPO is linked at the domain
so effects all OUs and uses "Restricted Groups" with just one group:
Looking at it's properties I see under "Members of this group"
a list of users/groups.
I need more fine grained control and am not sure on the best way to approach it?
If I delete this "Restricted Groups" setting from the GPO which applies at the domain level
what will happen ?
Will local admins revert to whatever they where previously on each PC or will they just stay as is?
Should I set "Restricted Groups" via another GPO at a lower level OU e.g. using inheritance ?