They can, if they have local admin rights. Then again, it's not a best practice to either change the ACLs on those directories, unless you tighten them up, or to give your users local admin rights.
_________________________
There are two types of vessels, submarines and targets.
