Pretty sure Windows 7 and later releases (and probably Vista as well), in vanilla status with default security settings, would not simply execute an AutoRun, and instead ask the user to choose an action, with the AutoRun being one of them.

Sounds like they are either running an outdated and unsupported OS, or intentionally disabling basic security features.

Pretty sure vanilla Windows 7, at default security levels, would not simply execute AutoRun when a thumb drive is plugged in, and would list AutoRun as an option in the menu. Sounds like either they are using an outdated release of Windows, or intentionally disabled basic security features.