Now that you've fired the admin that created that GPO... ;\)

Rather than disable the GPO, why not remove the Domain Users group from it and let it reapply, applying the settings without the offending group?

If you really want to script it, here's something I used in pre-GPO days to modify groups from a central admin workstation. You can wrap it in a loop that enumerates the computer names.. It requires PSEXEC.EXE and running using an account that has admin rights on the remote system.
 Code:

$aComputers = {get a list of computer names to put in the array using your favorite method}
$Group  = 'Administrators'     ; name of group to modify
$Remove = 'Domain Users'     ; name of object to remove
For Each $Computer in $aComputers
  $Cmd = '%COMSPEC% /c psexec.exe ' + $Computer + ' Net LocalGroup "' + $Group + '" "' + $Remove + ' /delete ">>groupadd.log')
  If $DEBUG
    $Cmd @CRLF
  Else
    Shell $Cmd
  EndIf
Next
This should get you started. You could also use tcLib and use it to push a scheduled task and immediately execute it.. a little more coding (4 lines to use tcLib) but avoids PSExec. I'd have the user log where they log in, then perform this remotely via an admin task, removing domain admins and adding the specific user.

The same method can be used locally to remove the Domain Admins and add the user.. possible only because the user currently has local admin rights. Two lines calling Net LocalGroup - one to remove and one to add, no remote exec needed.

Glenn
_________________________
Actually I am a Rocket Scientist! \:D