Full control issue in Sharepoint for all users in domain

Question

I just installed SharePoint 2013 and have issue that ALL users have by defult FULL CONTROL permissons and adding them to read-only group just ignoring. So they have access to sites settings etc. I checked all groups and there is nothing which can dilegate this kind of permissions. When I trying to perform permission check on user which is not exist on any SP site security group checker saying me that this user have full control...

Any suggestions?

Answer 1

Central-Admin -> Application Management -> Manage WebApplications -> Mark your WebApplication and click on User Policy. The rights granted there bypass every permissions granted on Sites or SiteCollections.