Has this machine been used on a domain? Is it possible that group policies have been pushed down, or the local security policy has been changed?