I need to remove users from the Local Administrators group - it's built up a lot of them over time. So I have created a temporary Organizational Unity with a temporary GPO attached to it, and I've used Restricted Groups to populate the local admin group with the required groups.
When a PC is moved into the temporary OU, the GPO is applied and the local admin group is changed (users removed). When the PC is moved back to the original OU and the test policy is no longer applied, it reverts back to the original members of the local admin group.
How can I make the changes to the members of the Local Administrators group persist even when the GPO that caused those changes no longer applies? I want to be able to move the PC back to its original OU and have it keep the new, shorter list of Local Administrators.
For context, I'm using a temp OU to control/test the removal of local admin privileges on our applications.