Removing admin access from workstations is a precisely wrong intervention if your goal is security. It's like making the client code responsible for enforcing

Removing admin access from workstations is a precisely wrong intervention if your goal is security. It's like making the client code responsible for enforcing database permissions. The only valid argument in favor of doing this is if you have non-technical users and need to manage workstation configuration centrally so that you don't get drowned in technical support work.