It's missing a vital suggestion.... remove the users from the (local) admin group...