Why aren't restrictions applied?

Question

Windows

For some reason, on one of the workstations, a regular domain user has elevated privileges. For example, it can remove / add devices in the device manager, change system settings, terminate processes, etc.
In AD everything is configured correctly. All other network users have adequate privileges.
What can be wrong?

Answer 1

and locally, the user is included in what security groups?

Answer 2

Maybe from added to the local PC administrators group on the PC itself?

Answer 3

Well, most likely he is in the local administrators group on his PC.