they could try setting policies to prevent changes.

They might also be getting browser hijackers because browser settings are not up to snuff.