$ 0 0 You can use Restricted Groups in GPOs.http://community.spiceworks.com/how_to/2123-add-an-active-directory-group-to-the-local-administrator...