Group policy can define which of your users should be members of a specific group. However, it lacks the granularity you sometimes need for more specific group membership segmentations.
Here’s an example. Your systems administrators and domain administrators should be in the local administrators group for all of your systems. However, if on some systems, Bob should be in the administrators group and on other systems, John should be in the administrators group, and so on, group policy cannot handle this.
But User Manager Pro Suite (UMPS) can. It offers a unique feature called “move all except” that lets you create mapping to define what specific group memberships should look like.
With “move all except” you could keep some of your users in their current local group and move other users to a new local group that you set up. This is especially useful for moving excess members of the local administrators group to a less privileged group.
See the Local Members section of the UMPS user’s guide for more information on "move all except".