Local Admins have Domain Admin Rights

A domain user who is in the local admin group on a nt4 workstation can add server tools on their pc, open it and have full access to all users just like a domain administrator. Where is this enabled? (pure nt4 network)