restricted groups GPO + event ID 637

[windowsfan]

I have configured restricted groups GPO for Administrators, Domain Admins and Ent Admin groups. I have total 6 Domain controllers, 5 sites.
In event viewer I see event ID 637 where its removing and adding Domain Admin and Ent Admin from Administrators group. How can I find out whats wrong? GPO looks fine to me.

 

[TechyMcSe2k]

If you are seeing this in the Security logs as a success audit, then the gpo is just doing its job. I think that is how it maintains the restricted group members. remove all just in case one got added and replace with the ones you specified.

 

[windowsfan]

I will find out how often it adds and removes groups.