I've been using WINDOWS Auth with ease and multiple group swith EASE for years..

More than likely the user is in a group for which is granted ELEVATED access.. Visit...

Control the environment.. By creating a NEW DB trigger and remove PUBLIC from any new DB created and or default the permissions so that you define when the db is...