If the target machine is domain-joined, a GPO may be overwriting local permissions.

Navigate to: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions .