Unfortunately, after a lot of discussion, I think this is the only solution, which I've put in IdeaStream;
Create the group Sec_Admins and apply to the 3 ManageSecurity but don't make the Administrators a child. Provision the users directly with access i.e. the group Administrators does not inherit the access - the users do. I know it can be done because it took me a while to do the opposite.
Sorry Marcus, that is what I stated above that I already tried. Even with Administrators not being a child of Sec_Admins, they still have access to manage security. I only had Users in my Sec_Admins group, no child groups, and the members of the Administrators group could still manage security. In OneStream, the Administrators Group has access to everything, except where the Nobody group has been applied.
