This is a new domain controller. I created users and created a security group called Local Admin. The users are members of this group. I created a domain group policy and used the Restricted Groups policy to add the Local Admin group to the Administrators group of the clients (Computer configuration > Policies > Security settings > Restricted Groups > New > Local Admin > Member of > Administrators)
The weird thing is that when those users login at the clients they have access to \server_name\c$ (admin shares). Access is denied when I delete a user from the Local Admin group.
Why can a client administrator access those shares?? Or am I doing something terribly wrong?