I'm revamping my company's service accounts, and we've discovered that some need to be able to log on locally, and some are OK with just logging in as a service. I've created two groups, SvcAcct_Restricted and SvcAcct_Full. "Restricted" is setup via GPO to be denied any form of interactive login. The "Full" group is a placeholder for now, but some stuff might get added to it later. I want each service account to be in ONE of the two groups. If a service account gets that needs full access gets added to the restricted group, services fail, phones ring, bosses blow things out of proportion, meetings meetings meetings, etc.
What I'd like to do is prevent any user account from being added to the "Restricted" group if it is already a member of "Full" and vice versa. I popped into advanced security settings, but didn't see anything that looked like "deny membership" and my Google-fu is weak today.
AD schema is at Windows 2008R2.
Any help is greatly appreciated!