my question is simple, how to avoid removing the domain admins group from the local admins group by a user when he is admin on the PC?
