Power users on 2003 server

Question

I have noticed the domain users group has been granted "power user" group membership on a 2003 server.
There is some sensitive information on the admin shares of this system, my concenrs are, with power user permissions over a remote server.... whats the risk?
The power users group does not have remote desktop permissions nor can they physically access the servers console (local logon), but I wanted to ensure there are no other ways a user could remotely access the server if they have power user permissions on
the server? Are there any other ways?

Answer 1

Microsoft has documentation for the rights of a
Power User in Windows XP. These things will generally apply to Windows Server 2003 (assuming it is not a domain controller)
Power Users 
The Power Users group primarily provides backward compatibility for running non-certified applications. The default permissions that are allotted to this group allow this group's members to modify computerwide settings. If non-certified applications must be
supported, then end users will need to be part of the Power Users group.
Members of the Power Users group have more permissions than members of the Users group and fewer than members of the Administrators group. Power Users can perform any operating system task except tasks reserved for the Administrators group. The default Windows 2000
and Windows XP Professional security settings for Power Users are very similar to the default security settings for Users in Windows NT 4.0. Any program that a user can run in Windows NT 4.0, a Power User can run in Windows 2000
or Windows XP Professional.
Power Users can:
Run legacy applications, in addition to Windows 2000 or Windows XP Professional certified applications.
Install programs that do not modify operating system files or install system services.
Customize systemwide resources including printers, date, time, power options, and other Control Panel resources.
Create and manage local user accounts and groups.
Stop and start system services which are not started by default.
Power Users do not have permission to add themselves to the Administrators group. Power Users do not have access to the data of other users on an NTFS volume, unless those users grant them permission.
 Caution
Running legacy programs on Windows 2000 or Windows XP Professional often requires you to modify access to certain system settings. The same default permissions that allow Power Users to run legacy programs also make it possible for a Power User to
gain additional privileges on the system, even complete administrative control. Therefore, it is important to deploy certified Windows 2000 or Windows XP Professional programs in order to achieve maximum security without sacrificing program functionality.
Programs that are certified can run successfully under the Secure configuration provided by the Users group. For more information, see the Security page on the Microsoft
Web site.
Since Power Users can install or modify programs, running as a Power User when connected to the Internet could make the system vulnerable to Trojan horse programs and other security risks.
Jason Warren
@jaspnwarren
jasonwarren.ca
habaneroconsulting.com/Insights