I'm fairly at home with Group Policy but this is sort of a strange one. I know security settings get applied every 16 hrs. I had a policy that added an AD group to the local admins (restricted groups). It would replace all other settings.
Now, we are migrating into a new domain structure and cleaning up our policies. I moved the computer to the new OU and it's accompanying policies. In the new env, there is no policy that sets the restricted groups.
To my surprise, when the computer was moved, some time after the move, all of the sudden admins no longer had admin rights. We obviously didn't remove them manually on the computer itself so this is somehow the result of moving the computerobject into the new env.
I would figure that a setting that has been set, stays set. Having said that, by moving the computer object and thus "removing the policy", i basically "change the setting". Maximum 16hrs later the settings get re-applied and the "empty" setting gets applied. On the other hand that doesn't make any sense. Cause the GPT doesn't contain any setting that gets "send" to the computer for processing.
So i'm confused as to why the group got removed from the computer. Can anyone explain this?