Restricted groups - how to add a member in a lower down GPO

Hi,

We use restricted groups to set administrator group membership at top level OUs. Lower down we recreate the restricted group membership properties and add individual groups for sub OUs and servers.

The problem with this is:

1. We have to copy restricted group members from top level GPOs applied at the OU level.

2. If we change the top level OU GPO restricted group members we must change the sub GPOs restricted group members to match - this is a pain to manage.

Is there a way to only ADD administrators to the local administrators group without impacting on higher up GPOs? I've tried using the "member of" restricted group property, but from my testing this doesn't work.

IT Support/Everything