User sees more permissions than they should.

System

We are not using LDAP. We have many Windows Groups and we add Active Directory users into those groups. Then, we set the groups associated to mbin containers. For the most part, it all works well.

However, we have some users that seem to have elevated permissions, they can see EVERYTHING and that's bad. We've spoken to mbin support several times and they have told us that a user is embedded in a group or something that gives them the additional permissions. No love there.

We've combed the specific users' permissions both on the server, Windows Groups, MediaBin, objects in Active Directory security groups, and naa daa.

In fact, we just added two brand new users, never used any of our systems before and they have permissions to EVERYTHING. Has anyone else had this issue or any ideas how to address it?