Question : Disable Domain Policy application, Domain Admin addition

Hello,

what i want to achieve, is disabling default domain policy application when logging onto domain. For now, what i have done, is removed Domain Admins from local administrations, disable all login scripts, and set HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Group Policy, and same key under HKEY_CURRENT_USER Permissions to Deny to Everyone. This seem to have fixed 90% of application, however, when logging onto domain, some custom created domain admin group still gets added to local administrators group. Does anyone know what other place should I block?

thank you.

Answer : Disable Domain Policy application, Domain Admin addition

The best option is just to put your administrators into an OU and block policy inheritance on the OU.
If you want to stop computer based policies then move their computer accounts into the OU as well.