Hi Les
I agree with you that putting Domain Users in the local Administrators group is a security risk.
The problem is applications that requires administrator permissions on the workstation to function.
And to put just a single user in the Administrators group cant be done, because people log in on different workstation.
But if you have a better solution, so please give it to me.

/Mima