A 'user' if they are part of the local admin group can do any of this. But if they are a user and in the local user group they shouldn't have access to it by default.
Now if this is on a domain, you have a lot more options on how locked down you can make the computer via GPO.
