iTunes and Safari apparently install without admin rights?

[cheredenine]

So i got wind of itunes and safari installed on a pupil PC - odd as i haven't put them there and no-one else has admin rights to the PC. Do some digging and found some pupil has downloaded them and the install process has run far enough to install these two apps with only domain user rights. Not sure what state they in as to whther they run properly, but i'm a bit bemused as to how they could get installed without admin rights. Any ideas?

[Azhibberd]

In all honestly... Best bet is to lock down what exe's can be run(Can be managed through GPO if your using AD).... as well that is a rather large security risk... Also maybe consider locking down write permissions to the C drive?

[3s-gtech]

They don't use Windows Installer, so they have a much greater chance of being able to write everything they need. A few programs will get round all the usual GPO blocks - that's why I've changed the ACLs on the C: root and Program Files root folders now, seems to put them off.