Forcing Domain Admins to use AGPM (but not really)

And the real solution? Don't have folks log on as domain admins unless absolutely unavoidable and delegate permissions they need on a day-to-day basis to their Tier 1 accounts. If your security architecture can't enforce simple rules like this, then you have an even bigger problem on your hands than editing GPOs. Ironically enough, not having DA log on every day *is* a practice that Microsoft recommends and has done for quite a while.