To whom this may concern,

Administrative settings in the newly improved and enhanced Group Policy that comes with Windows Server 2008 has gone beyond the call of duty with some settings, as they fix issues and secure computers like we have always wanted to, but never had the tools before. Applying these security settings to your workstations will increase the overall security, by reducing the attack surface that is available. One of the most vulnerable settings that can be granted to a user is local administrative access. By adding the user account to the local Administrators group, the user is granted ultimate control over their desktop. The user can perform almost any action, even if the network is configured to deny this access. Actions that a user can perform, due to them having local administrative access, include, but are not limited to, the following: remove their computer from the domain, modify any registry setting. modify permissions on any folder or file, modify any system setting, including settings that are in files in the System folder, install any application, uninstall applications, security patches, or service packs, access any website allowed by firewall, and download and install ActiveX controls, Web applications, or other malicious applications downloaded from the Internet. Although there is a need to have users running as administrator to allow certain applications to function, this type of access is very hazardous and endangers the desktop and the entire network to potential security breaches and attacks. It is essential that the local Administrator password is also reset. This is due to the fact that the user may have had administrative privileges before removing them from the local Administrators group, therefore they could have reset the Administrator account password to something they know.

References
Melbour, D. (2014, April 30). Top 5 Security Settings in Group Policy for Windows Server 2008. WindowSecurity.com. Retrieved May 21, 2014, from http://www.windowsecurity.com/articles-tutorials/windows_os_security/Top5-Security-Settings-Group-Policy-Windows-Server-2008.html