Restrictions on local admin rights?

Question

Access rights

Most users have local administrator rights on their PC, as they need to install software, remove, run as administrator. All work from domain accounts.
Is it possible to prevent them from renaming a PC, changing network settings, changing local user accounts?

Answer 1

There is no such differentiation of rights - you are either an administrator or not. It would be more correct to remove users from the administrators group, if we are talking about the fact that users do not cheat too much.

Answer 2

It happens that a user has special software that does not work without admin rights, well, finally, nothing. Then I create a Local admin account and teach how to run software through it. If the user does not intend to harm himself, he will not use the account to the detriment, these accounts are not associated with the domain, this account can only run this program and no others.
In any case, if the user is too advanced and wants to seize ownership of the computer with physical access to it, he will do it, but it’s definitely not worth simplifying his life.