Domain user with local admin rights OFF the network

Having a issue with our new WIndows 7 machines. Have added pc to domain (2003 Server/AD), have added domain user to local admin group (e.g. DOMAIN\user) Can run applications as administrator as long as they are connected physically to domain. Pull the plug, the user DOES NOT have admin rights to add printer, run app. etc. Never had this problem with XP. If you plug the machine back into the wire, admin rights are back... What do I need to change?
Thanks in advance.

very cool....guessing GPO domain or perhaps local, stopping the cacheing of security credentials. Can you log off and log onto the computer with the domain users credentials when they are unplugged

You CAN login using Domain user credentials when disconnected; just no admin rights. No changes to GPO, using only default. Should be no local policy being applied.

Any errors being reported in event viewer, any pop up dialog box messages, options greyed out, I assume we're talking about adding a local printer when disconnected so what exactly is happening when you try, or am I completely missing the mark

Haven't looked in eveny viewer - will do. Adding a local printer was EXACTLY what the user was trying to do - came back with error " You need to be logged on as administrator - or have admin equivl rights..." You are right on! We have numerous users that work locally in office (on Domain) that take their laptops home. One profile, one user, same files, no syncing, etc... User took laptop home, tried to add printer - Let me take a look at event logs.

You can have a look at this, since apparently your domain user, who has been added to the local administrators group, is still not being recognized as a local administrator it may help. It seems the situation is the same as yours it discusses a local security policy and adding a guid, I haven't had time to test it but it might help get you by for now Install printer without being administrator

This is just another shot in the dark here but have you tried to disable locally, UAC (user account control) on the Win7 laptop, just as an experiment. I have seen some weird behavior in domain environments associated with this applet. You can look here if you aren't familiar Disable User Account Control (UAC) in Windows 7 - IIS Hacks | Server and System Administration

Only thing in event viewer worth noting; "The processing of group policy failed bacause of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has been successfully processed. If you do not..." Will take a look at Guid info. Bigger concern was no admin rights for programs, changes to registry, etc - Printer not such a worry. '

Security log shows successful logon using explicit credentials followed by an account was successfully logged on, then special privileges assigned to new logon. ACU was/is set to Notify me only when making changes...Will drop to lowest and try this agin.

Local Group Policy is as follows; will change one at a time to see what happens...

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode” IS set to “Elevate without prompt”

Detect application installations and prompt for elevation” was set to "Enabled" will change to “Disabled"

Run all administrators in Admin Approval Mode” IS set to “Disabled"

Only elevate UIAccess applications that are installed in secure locations was set to "Enabled" will change to "Disabled" - Let's see what happens - Thanks everybody!!!!

Please keep me posted, very interesting problem. I wouldn't be suprised to find out that UAC doesn't play nice with cached domain credentials

Made all changes to registry (so user does have some rights) to disable UAC, made the changes to the Group Policy. No change - Will look back at the GUID to see if it is just printer install - Strange - I was able to start a program setup from DVD (Roxio). May just be printers; I have created a local account for user to restart if necessary to get around issue. I just know more will be coming down the road. Let you know once I read how to add exception.