Hello Everyone. Can anyone give me a few instructions or an example for this particular question? show me an example of how this should be done. thank you so much.

Pre-Steps:

1. Select one of your Department's OUs (non-IT). Move your live Win10 client, PC01, to this OU.
2. Create (or use if already created) a new IT user account, named after the Department-OU; eg, if your OU is called Retail, name the user account Retail-IT.
3. Create a new SG named after the OU, eg, Retail-IT-SG. Add the user account created above to be a member of this SG.

Create a GPO and link it to your selected Department OU.

1. Configure Account Password & Lockout Policies as you wish
2. Configure Logging Policies as you wish -- but do configure retention policies to overwrite as needed
3. Configure Restricted Group Policy: Add the SG you created above to be a member of 'Administrators'