User Rights Assignment

User rights assignment snap in determines what actions the user will be able to perform. settings which require a change are explained below

To modify the user rights settings:

Local Policies → User Rights Assignment
Double-click on the desired Attribute in the right frame.
To add a user or group, Add User or Group → Enter user or group →
Add → OK → OK
To remove a user or group, select user or group → Remove → OK

Remove the power users group from all user rights.

Backup files and directories remove the backup operators

If you require backup operators for your network you can keep it however administrators are granted this right.

Bypass traverse checking give permission to users and remove all other groups

Debug programs is a right required for a developer otherwise remove all the users from this setting

Force shutdown from a remote system remove all groups except administrators

logon locally give this right to administrators and users group and also for backup operators if required.

Restore files and directories if you require backup operators assign the right for them or else you can remove all the groups except the administrators

Also see Least privilege policy