Group policy can define which of your users should be
members of a specific group. However, it lacks the granularity you sometimes
need for more specific group membership segmentations.
Here’s an example. Your systems administrators and domain
administrators should be in the local administrators group for all of your
systems. However, if on some systems, Bob should be in the administrators group
and on other systems, John should be in the administrators group, and so on,
group policy cannot handle this.
But User Manager Pro Suite (UMPS) can. It offers a unique
feature called “move all except” that lets you create mapping to define what
specific group memberships should look like.
With “move all except” you could keep some of your users in their current
local group and move other users to a new local group that you set up. This
is especially useful for moving excess members of the local
administrators group to a less privileged group.
See the Local Members section of the UMPS user’s guide for more information on "move all except".
