Problems with corporate network domains? ? ?

famous13615

Problem Description:
  
  The client computer was added to the domain, and a domain account with ordinary permissions was added to the local administrator group of the client.

Local login or domain account login, domain administrator does not need domain administrator privileges, as long as the local administrator privileges? ?
  
  If local login is restricted, login directly with a domain account, you must add the domain account to the client's local administrator group, so

There is no problem installing software on the client side, but in this way, this domain account can create a new local administrator account,

You can quit again, so it feels very contradictory.

  I would like to ask experts, how to solve this problem, restrict the following computers from leaving the domain?

sh280303120

And add the domain account with normal authority to the client's local administrator group
-----------
Why join the local administrator

sh280303120

If you want to set client permissions, you can set it on the server

If you set it this way, the domain is meaningless

famous13615

If you do n’t set it like this, the following client ca n’t install the software by logging in with a normal domain account

xfinal

Software distribution with group brochures

famous13615

Can't you distribute any software?
What I want is not to restrict them to install their own software

sh280303120

1 Can use the distribution strategy

2 Temporarily use run as installation

xfinal

Software distribution can be specified, so is it necessary to use the domain?

famous13615

1 Can use the distribution strategy

2 Temporarily use run as installation


Can you elaborate? Thank you!

How to install with run as?

famous13615

One can make the following computers automatically upgrade patches
Isn't the software distributed in the * .msi package?
Not all software?