deny editting of local policy

[Cstorms]

Is there a way to disable a domain user (with local admin rights) from changing local security policy? I guess I am unsure of where I would find that in GP or if its even possible. Suggestions? The user account needs local admin rights.

All tips appreciated.

 

[Cstorms]

Just so you know, we place a software restriction on the gpedit.msc, although they can still make an mmc with this snap in, this should do the trick for the people who dont monkey around to much.