Restricted Group as like as domain admins

Question

I have configure Restricted Group in GPO in mydomains.com.
So I added a group called 'ABC_Support' and on the second box (This is group is a member of) was Administrators.
in ABC_Support group, there is one user called 'tech_admin'. 
Result: GPO was successfully pushed into workstations, and ABC_Support is a member of local administrators and tech_admin can able to administer the workstations.
Problem: The problem is that, in domain controller, you will see the ABC_Support is also a member of built-in   Administrators. The tech_admin is able to access domain controller remotely and can create users and really like domain admins. 
Is there any solutions that prevent the problem?  and is this behaviour is normal? is restricted group designed like that? I know there is a GPO under user configuration "local users and group".

Answer 1

Hi Ben,
As others suggested, please make sure that the Restricted Groups setting was not applied to domain controllers. To do this, we can link the GPO to the OU where all workstations reside,  or we can use security filtering or WMI filter to filter out domain
controllers if we link the GPO to the domain scope. 
Besides, as you know, instead of Restricted Groups, we can also use Group Policy Preferences Local Users and Groups extension to make a domain user a local admin. In this way, we can use GPP item-level targeting to apply our settings to specific targets.
Regarding this point, the following article can be referred to for more information.
How to use Group Policy Preferences to Secure Local Administrator Groups
http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/
In addition, regarding security filtering, WMI filtering, and ILT, the following blog can be referred to for more information.
Security Filtering, WMI Filtering, and Item-level Targeting in Group Policy Preferences
http://blogs.technet.com/b/grouppolicy/archive/2009/07/30/security-filtering-wmi-filtering-and-item-level-targeting-in-group-policy-preferences.aspx
Best regards,
Frank Shen
I have applied the GPO of ABC_support (restricted group) with WMI filtering and it is not applied to domain controller. On Domain controllers OU, I made another GPO to deny this group to remote desktop and login locally so that the group will not able to
do unexpected activity.
However, I found that that the "\\mydomaincontrollers\Anydrive$ such as \\c$" can be accessible from workstations ou. If I deny the terminal service in GPO on Domains abc.local, it will apply to all computers and shared folders '\\servers\example' cannot
be accessible if I deny login through terminal services. why is that? suppose network and shared map folder use different ports and remote desktop/terminal service use different ports.
there are lot of thousands workstations in computerOU with different child domains and parent domains as well I need to manage. so it's really hard for me to move to another ou.
please advise