First, I was actually referring to a Computer Configuration GPO, not User Configuration. This way, as long as the computer is a member of the domain, whoever logs on has Local Admin rights. Though I agree that users shouldn't have local admin rights, unfortunately we use a third party...