I work in an organization that uses Faronics Deep Freeze to prevent users from making changes to the computer. I had always been under the impression that a standard user (a user who is only a member of the "Users" group) can't make any system-wide changes. The description for the group states:
Users are prevented from making accidental or intentional system-wide changes and can run most applications
The senior system administrators here tell me this isn't true in practice. What is an example of where this isn't true? Do standard users have any write permissions outside of %USERPROFILE% or HKCU?