PCI version 3 section 5.3 states
Ensure that anti-virus mechanisms are actively running and cannot be disabled or altered by users, unless specifically authorized by management on a case-by-case basis for a limited time period.
Is there a definition in PCI of "users"? Or is that left for us to define in our security policy?
Strictly speaking everyone who interacts with the system is a "user" but some users will also be administrators with the ability to change the group policy for the anti-virus system.