Suddenly all users can install programs without admin rights

I just discovered that standard users on my server 2008 AD network can install programs without having to have the admin username and password.

I am unsure why this is, it was asking for admin credentials earlier last week. I checked the GPO's and nothing has changed or should affect this privilege.

Anyone have any ideas what happened or how i reset it to "demand administrator account to install or make major changes"?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jeremy WeisingerSenior Network Consultant / EngineerCommented:
Can you give an example of what programs they are installing? Can you also look to see what users and groups are listed in the local Administrators group on a client machine? What operating systems are in use?
Check the Domain Administrators Group... make sure users are not listed...or a user group is not listed.

Check the local administrators group on the Pc's... make sure that the user is not listed.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Darius GhassemCommented:
Make sure that a GPO is not adding them to the local admin groups. You can add through the Restricted Group Policies in a GPO so check to make sure this policy is not set.
Your Guide to Achieving IT Business Success

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

somewhereinafricaAuthor Commented:
@ my username:
They can install java update, flash update, install a whole HP Laserjet setup, and one downloaded some software and installed it (like some video encoder or something).

The only 2 entries in domain admin are:
"Administrator" and My own user account
They are not listed ion the local administrator on the machine in question

Since i didn't set this up, no they are not members of anything else than the WSUS that was automatically created by the WSUS install
Darius GhassemCommented:
If you remove them from the WSUS can they install? Are they in the Power Users group?
somewhereinafricaAuthor Commented:

You know I was thinking about that...

When i installed the WSUS on the server it created a "WSUS" policy that I have added all the workstations to. Should I not have dome this? ...and would that really give any of the local users free install rights?
Darius GhassemCommented:
I don't know if it actual did give the users rights but a test lets see if it did since this the only thing you have changed, right?
somewhereinafricaAuthor Commented:
well, i did play with some other GPO's i created, but i deleted and unlinked them. I guess that's the only thing... I will test tomorrow, thanks.
somewhereinafricaAuthor Commented:
it wasn't the WSUS at all, it murt have been that they also existed under the machine with same logon credentials as on the server. I will delete the local users on the machines and that takes care of it. Thanks for your help...
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Project Management

From novice to tech pro — start learning today.