I use group policy to enforce via Restricted Group who is in the local administrators group. However, some users we have deemed should be a local admin on their machine and they drop out of the local administrators group when the next group policy update takes place. How can I add a user to the local administrators group and prevent it from being overwritten by the Restricted Group?
Your policy is doing what it is supposed to be doing. You need an exclusion to the policy - effectively denying the policy from running on your specific computer - or an update to your methodology. My preferred method in a case like this is utilizing group policy preferences for group memberships... it's a lot more flexible.