If a student runs an exe installation file it will say that it wants to make changes to the computer, they can select yes and it installs. This is very strange, as it does not ask for admin credentials and they are only a member of "domain users".
Is that normal? Can we disable this access either before or after they click yes? I've played around with GP settings to deny elevation requests but they do not seem to do anything.