Modifying local groups using GPO restricted groups