I'd like to lock down software installs on workstation in a domain. My plan is to remove users as local admins and give them standard user rights to workstations. Then setup a limited rights admin account or group that can be used for installing software on workstations, instead of using the domain admin's account. Something that I could give the local managers access to either through a group assignment or specialized admin type account.
Thanks.
