Update of Client SW

We are trying to upgrade our PCs through the ACU as users log on. As a test we set up a group and added a test user to the group, the group members are given local Admin dynamic user rights. On logging onto a Win2K PC the upgrade is completed but the user on being removed from the group retains the Admin privaleges. Without these Admin rights the following msg is displayed on the PC ‘You must have Administration right on the workstation to install this SW’
Any help appreciated