I have active directory 2003 and windows xp running on clients so I don't want any of my users to have any admin rights on their PCs and I have already gave them local admin rights So Without to go to each PC and remove it by hand . How can I remove my users from local admin rights with a GPO? Any advice would be appreciated Thanks
Computer configuration > Windows Settings > Security Settings > Restricted Groups.
If you set that up with Using the "Members" Restricted Group Portion of Policy, it will remove anything else that is listed locally. It will only apply the group that is in your policy. You can read more about it here