Hi ,I hv windows 2k server with 200 users. All the users arepart of local admingroup for their computer. I would like to remove local admin access for users from all the machine through Group Policy.Kindly advise.

Hi, You can use Restricted Groups policy to control group membership.Analysis:========Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. There are two ways to apply Restricted Groups policy: Define the policy in a security template, which will be applied during configuration on your local computer. Define the setting on a Group Policy object (GPO) directly, which means that the policy goes into effect with every refresh of policy. The security settings are refreshed every 90 minutes on a workstation or server and every 5 minutes on a domain controller. The settings are also refreshed every 16 hours, whether or not there are any changes. Suggestion:========= For your scenario, to remove users from local admin, you can follow the steps below: 1)Create Restricted Groups policy under computer configuration\windows setting\security setting 2)right-click Restricted Groups policy and choose add group 3)In group column, input local admin that should be equal to the exact name of your local admin group 4)In Members of group, input members. Any members which is not specified in the policy are removed during configuration or refresh.