Confirm that the staff aren't local administrators by checking the local Administrators group on the machine.
You should be able to remove these by creating a GPO which manipulates the local Administrators security group. This can be done using the "Restricted Groups" section in your GPO:
Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted
(NB: Be aware that this will effectively overwrite the Local Admin group so ensure you include anyone that's required to be a local administrator)
Or, if you've set up Group Policy Preferences, you could use that too for more flexibility.