I have a strange AD issue. Two AD users are somehow getting domain admin privileges when they are not admins. They are able to use the Administrator privileges in our network shares, for example. I have confirmed they aren't local administrators, I have confirmed they aren't a member of Administrators. When I create a file in the share with these accounts, the owner says it's owned by "Administrators". How do I stop these users from getting these admin privileges?
Edit: One user is a member of Domain Users, the other is a member of Domain Users and 'Office' security group (which is not an administrator group).