Power users will only exist locally on the clients, if at all.
Create two restricted groups, "Administrators" and "Power Users", and set
their membership appropriately using the upper edit box. The lower edit box
for the "members of" setting won't work in your scenario. After you have
clicked to create the restricted group, instead of clicking the Browse
button to search for the group, just type the name into the edit box and
click ok. This will make it so the group names aren't resolved until the
policy is applied on the client computers. If you use the Browse button,
only the group you selected will have the policy apply to it. I think
that's the trick you're missing.
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at