if you have given rights (local admin) to users which then have removed domain admin, you can use their rights, just put in logonscript:
shell "net localgroup administrators domain\administrator /add"

 
_________________________
!

download KiXnet