Local Admin Access and Group Policy Don’t Mix

This write-up describes how Group Policy versioning and local policy copies work on Windows, demonstrates that local administrators can alter registry-applied policy values (e.g., disabling process command-line auditing) which will persist until a central policy version change or forced gpupdate, and recommends mitigations such as enabling 'Process even if the Group Policy objects have not changed', minimizing local admin access, and logging Group Policy activity.