of course every user is an "expert" I don't tell the engineers how to do their stuff (I did engineering at Uni) so no need for the engineers to fiddle with their client device. If they NEED admin as part of their job that's fine they can have a seperate local admin account and use elevated privilege NOT run their normal domain account as a local Admin with all the risk to the business that that gives.
Biting the hand that feeds IT
