I always check to see what groups of users this GPO actually applies to

At this point, I always check to see what groups of users this GPO actually applies to. It’s
always good to pay attention to who has the Apply Group Policy permission. Right-click
the adminpak group policy icon at the top of the list. Select Properties. In the properties page
(see Figure 12.19), go to the Security tab. Click Domain Admins and notice that Apply Group
Policy is not checked in the list of permissions. They can read it, but they don’t have to obey
it. To make sure the group policy applies only to them, check the Apply Group Policy box, and
make sure it is unchecked for your general authenticated user. That way, if someone accidentally
gets moved to the IT Staff OU, they won’t have administrative tools.