Right, I work in a college myself and most students don't know the difference between "having local admin access" and "I can see a shortcut I couldn't before" and "I can get a command prompt up, never mind what I actually can and can't do in it". Don't try and diagnose the problem based on what a student is telling you. The most likely explanation based on what you've said so far is that either they're not getting local admin access or they're not going about it the way they claim to be doing. Simple as that. Worrying about this isn't helping you fix the actual issue, whatever that turns out to be.
Assuming the windows installation/image you use and the GPOs you use are even vaguely standard, they're not getting local admin access just because they unplugged the computer from the LAN. The issue with GPOs not applying under those circumstances is a well known one, however, but this just stops the settings in those GPOs from being applied consistently/at all.
I think the first thing you need to do is look at the logs and group memberships of their accounts as MDMarra suggests, and secondly, maybe try replicating what they're doing for yourself, then you'll understand exactly what it is they are seeing.