https://www.grouppolicy.biz/2015/03/how-to-stop-local-administrators-from-bypassing-group-policy/