Configure Offer remote assistance removes all helpers, then re-adds. Misconfiguration? Is there a better way?

Question

Hi, my domain is at the 2008R2 functional level, and I have a group policy which configures the "offer remote assistance" setting (Computer Configuration>admin templates>System>Remote Assistance).  I have noticed some interesting
behavior, and I'd like to know if there's a more efficient way to do this:   Whenever this policy gets applied, it seems as if it removes all individuals from the "Offer Remote Assistance" group, then re-adds them.  I notice this because
when I update the group policies on the clients, I see security log event 4733 (removing the account from the "offer remote assistance group") for each defined helper, then see security log event 4732 (adding the account to the "offer remote
assistance group") for each helper.
Is there a better way to accomplish this without adding and removing the accounts from the "offer remote assistance" group every time the policy is refreshed?
I ask because I'm using a SIEM for logging privileged account usage or membership changes, and the hundreds of events per day are a bit noisy.
As always, any recommendations are greatly appreciated!
Thanks,
Kevin

Answer 1

> the "apply without changes" setting that Martin mentioned?
Check http://gpsearch.azurewebsites.net/#329 - enable this and do not
set "apply without changes". But be aware that regardless of what you
configure, security policies WILL apply every 16 hours or so in the
background. That's a hard coded value and behavior, and this applies
only to security settings.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))