Assuming the windows installation/image you use and the GPOs you use are even vaguely standard, they are not getting local admin access just because they unplugged the computer from the LAN. The issue with GPOs not applying under those circumstances is a well known one, however, but this just stops the settings in those GPOs from being applied consistently/at all.