Previous administrator configured Restricted Groups in the Default Domain Policy. In the Restricted Groups for Administrators, they've added the Domain Admins group as well as a domain security group called Local Admins. They populate the Local Admins group with about 15 users that require local administrator access on their own systems. They've scoped this out to an OU that contains all computer objects in the domain. Expected result, as guessed, is that these users now have local admin access on all hosts.
I would like to redesign this a bit and am looking for some advice. Currently, if I grant a user local admin access on their own system; when GPO refreshes, the Restricted Groups portion removes their access. For obvious security reasons, I don't want them to have access on every machine. Management is aware of the risks associated with users having local admin access and has accepted the risks (these are mostly in-house developers).
Ideal goal....develop method where Domain Admins have access on all systems while being able to assign local admin rights for a small group of users to their OWN systems and no one elses. I'm not entirely certain if I can do this purely with Restricted Groups, or through a mixture of multiple GPOs. Am completely open to any other ideas from people who have implemented this too.