AD Group added to Local Admins not working on domain-joined PC - adding a user directly to local admins does?

Solution 1:

To long for a comment; but To make a simple test; Make like in the start; please add the LocalAdmin groups to your Local Admin group and remove the direct Bob entry

Login as Bob on Harry computer. Issue a whoami /groups /fo list, let us know the output. You should see BUIlTIN/Administrator, if not then;

Your bug remind me of nested group limitation/bug, as from memory with GPO, aka Restricted Group policy you can bypass that restriction. I suspect your domain level dont help us there.

Not much documentation still exist, but see there;

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc776499(v=ws.10)?redirectedfrom=MSDN

or there;

https://www.cbfive.com/no-local-group-nestingeven-if-it-looks-like-there-is/