DOMAIN
|___OU#1
|___OU#2
|_hepdesk

on the helpdes OU we have the following GPO

restricted group > on "member of this group" / grup name = administrators (local group) we added the...