How can I control local user group membership via group policy?
You can use Restricted Groups policy to control group membership on domain clients. Restricted groups allow an administrator to define the following two properties for security-sensitive (restricted) groups: Members Member Of The “Members” list defines who should and should not belong to the restricted group. The “Member Of” list specifies which other groups the restricted group should belong to. For example, if you would like to add a global group to be a member of Administrators group on all workstations, you can configure the Restricted Group group policy.