Domain users being added to Administrators

Hello all,

I have ran into a problem where our doamin users group is being added to
our administrators group nightly. I have tried several different things, but
to no avail. I am beginning to suspect that we have a hacker running loose
on our network here. Is there a way that I can lock this out short of using
the GPO?

Thank you,
Brett
.