Was trying to create a gpo in the domain controllers ou to change the buildin\administrators group uaing restricted groups but decided against it and impressively clicked ok instead of cancel and it set administrators group to none on the primary DC and replicated almost instantly. Is there any fix to disable this gpo without doing a dcrestore? I am pretty sure noone in this environment knows the password that was set when the DC was promoted.
Because the use of Restricted Groups was intended to manage the membership of local security groups and not domain security groups (which isn't supported by Microsoft), you normally could reverse the effect by removing the Restricted Group from the GPO or unlinking the GPO altogether, which will set the group membership back to the state it was in prior to you configuring it via GPO. Because you did this for the Builtin\Administrators domain group I'm not sure what the outcome will be but if you still have access to the GPO you might try that to see if it resolves the issue.