We have a GP that adds a group of users to the Local Admin group on their workstations. We found out later that the GP was applying to the servers as well. Now we cant have that. So I made a Server group and went into the policy delegation. Clicked advanced and added the group. I clicked Deny "Apply Group Policy".
I logged into a server, removed the group from local admins, ran a gpupdate /force. And checked to see if the group was re-added. It was. I have been trying to figure this out for a while with no results. Please help.