Remove users/groups from Local Administrators by GPO on Active Directory (AD)
🔹 Remove users/groups from Local Administrators
Open Group Policy Management
Edit or create a GPO (e.g. Remove Local Admins)
Go to:
Computer Configuration
└ Preferences
└ Control Panel Settings
└ Local Users and Groups
Right-click → New → Local Group
Configure:
Action: Update
Group name: Administrators (built-in)
In Members:
Remove users/groups you don’t want (e.g. local user accounts)
In Members to add:
Add only allowed groups (e.g. Domain Admins, IT-Admins)
Click OK
✔ Prevents unauthorized admin access
✔ Doesn’t wipe required admins
✔ Recommended by Microsoft
🧪 Verify on a Client
Run on a workstation/server:
gpupdate /force
net localgroup administrators
🛡️ Pro Tips
Always keep at least one domain admin group in local admins
Test GPO on OU with test machines first
Combine with LAPS or Windows LAPS for security