Question : user rights and administrative rights problems on domain

Windows server 2008 std x64
Win 7 Pro

Some of my users seem to have administrative rights even though they should not have.

They are all logged on to workstations that are members of the domain with the same GPO's assigned to them, all the users have the same rights, there is nothing that should make anyone different from anyone else. Yet some users can pretty much do what ever they like as if they were administrators.

• the machines were originally set up using an local account that had nothing to do with their user names (so they are NOT local administrators).

• The machines only have one GPO assigned to them, and that is the one automatically created by WSUS

• The machines in question are also identical (dell laptops)

So there is no consistency at all that I can use to troubleshoot...

1 - Is there anyway I can check if the users in question have elevated rights?

2 - Is there anyway to re-set their credentials to 'normal'?

3 - Why is this?
 

Answer : user rights and administrative rights problems on domain

Have you looked in the local administrators group yet? Who ever is in there is an administrator. If there is a group in there make sure your users are not in that group.