Well Well, I tried enabling the guest account to see if at least THAT account has limitations, and what do you know, the GUEST account has admin access as well. Regedit, snooping others' profiles, uninstalling programs, create local Administrator accounts, you name it. What am I doing wrong?

Anyone? I can't seem to find anything on this from google? I'm completely stumped. I recreated my entire image with no result.

OK, I made a discovery. There's nothing more satisfying than having a conversation with myself here, folks. The local Administrators group on the machines in my image contain "\LOCAL" as a member group of "Administrators." I deleted this group and that has solved my problem. I still want to know why this was included in the image if I never added it, and it's not in group policy.

OK, I made a discovery. There's nothing more satisfying than having a conversation with myself here, folks. The local Administrators group on the machines in my image contain "\LOCAL" as a member group of "Administrators." I deleted this group and that has solved my problem. I still want to know why this was included in the image if I never added it, and it's not in group policy.

Hi, I would like to verify whether the "\LOCAL" is in the administrator group after you installed the system? Whether this is a custom installation image? In addition, you can also check the server site settings to check the result. Regards Vincent Wang TechNet Community Support

Hi, I've been breaking my head on this all day. I am creating a domain for a school environment. All staff members are being given Administrator rights to the local machines so that they can install whatever they want. Students are to be denied admin rights. The solution should be simple, right? Create a security group for the staff members, and add that to a Restricted Groups GPO to add Administrators membership for that group. The students, who aren't members of that group, should by default not have admin rights to the local machine because they were not specifically added. This isn't working. The student account has admin access, and I find no place in which their group was added to local administrators. HELP!

Well Well, I tried enabling the guest account to see if at least THAT account has limitations, and what do you know, the GUEST account has admin access as well. Regedit, snooping others' profiles, uninstalling programs, you name it. What am I doing wrong?

I built an image using an OEM Win7 Pro CD (w/o SP1), installed all of my programs, installed all of windows updates, and syspreped with generalize and no unattend file. WIM was uploaded to WDS via a caputre image, and subsequently deployed via WDS. Magically, \LOCAL appeared as a member of the Local Administrators group. I used GPO preferences to remove the group, but for academics I want to know how this happened because I seem like the only one this has happened to.