Windows shop, running active directory. At some point over the past 4 days, I have a few users whose C:\ ownership changed from DOMAIN\user to builtin\adminstrators on its own. I've verified the builtin\adminstrators still consist of domain admins, the domain user, a LAPS managed local admin and there are no other local accounts active on the PC.

This normally wouldn't be an issue, but it's suspicious that this happened on its own to a few different users. It was discovered as it was found by github during a git clone to a local repository and it threw a security error saying the owner of the files had changed from user to builtin\admin.

Has anyone seen this before?