How to add a *local* group to local Administrators via group policy

scenario:

i manage set of computers in ou within organization's ad.
i not have control of gpo's @ top of ou hierarchy nor want break inheritance of gpo's.
my organization has top-level gpo clears out local administrators group , adds specific set of domain users , groups.

problem:

i want able make some users administrators of own workstations.
i want without having make separate ou each of these users' workstations. list of users small enough don't mind giving them admin rights workstation.

proposed solution:

i want make local group on computer called, say, "extralocaladmins" , add that group local administrators group. then, can add individual users each workstation's extralocaladmins group.

where need help:

because top-level gpo's clear , repopulate local administrators group on every gpupdate, need way add extralocaladmins group administrators without clearing out domain users/groups have been placed there top-level gpo's (and, of course, without deleting/re-creating extralocaladmins). problem is, i've been unable work. i've tried using restricted groups specify .\extralocaladmins , add "this group member of: administrators", isn't taking effect.

any ideas? there better approach should using?

> * want make local group on computer called, say,

> "extralocaladmins" , add /that/ group local

> administrators group.

you cannot. local groups cannot nested.

what can do: use gpp "local users , groups". add user directly

to local admins if member of given domain group (item

level targeting).

example:

johndoe logs on johndoeworkstation. create domain group

"johndoeworkstation-admins", add johndoe group.

in gpp local users , groups, add local administrators group ,

add %logonuser% member. enable item level targeting, filter

"security group", "user member of", group name

%computername%-admins (do not use object picker here!).

done...

Windows Server > Group Policy

Combine