Students can install software! I can't find where this was set.
I'm doing a bit of work in a school where the last guy set up the 2003 domain as if it was NT. GPMC wasn't installed when I arrived. He has given students permission to install whatever they want. I can't find where he gave them this ability. I've looked at the Default Domain Policy, run RSOP on the OU containing the student account, and then searched in AUDC for Authenticated Users being a member of Administrators etc. I also created a test account and it had all the permissions it shouldn't, too.
Anyone any ideas?