Without escalation of Privs?
And, the fact of the matter... not that they by-pass them, are they even checked? By assumption or by method something has to be getting around it.
And the Local Policy over rides the others. So if the Citrix thinger you and andread are talking about, it doesn't amtter what DS groups memberships. It ain't supposed to be able to do that. But does.