I am changing some permissions on a small work network that I've been playing in. Domain admin and administrator permissions were so tied up that they essentially were the same account.
After getting everything clean I am finally able to have separate permissions on the domain controller. However when I log into a domain admin account and try to run local security policy or group policy management it tells me its blocked by group policy. Add the account the admins and it works again.
I have been unable to find any restricted applications anywhere. The DC's do have their own modified GPO's however I have not found anything to show as the culprit. I have assigned all the same user rights found locally on GPO as administrators as I have domain admins.
Any help is appreciated!