At work, our developers are local administrators on their Windows 10 machine. This is risky since we want to somewhat mitigate risks such as drive-by-download, but we also want productivity and some degree of freedom so we don't want to force them to go through helpdesk for every software update.
We accept the fact that we believe that no internal employee is malicious (this is not to be discussed - just a fact to take into account for this question)
Therefore we asked IT that developers are not local admins anymore, but have a separated account that they can use when they install software. In practice, I think that if they need to install such software, a pop-up comes up, they type the credentials of the other local admin account, the install is done, and that's it, they can then use the program with the unprivileged account.
IT tells us that this is not possible (the privileged account would be Domain Administrator, which is not OK).
Is this true? Is it really not feasible to do this ? It feels obvious to me but I never managed that before (back when I was a dev, I was simply never admin, but here management won't allow that due to productivity issues)
We just want our devs to do their daily tasks on unprivileged accounts but we want to allow them to install custom software for their work (they are aware of risks, know to download from official and trusted sources, they know how to check hashes etc)
This question does not help me entirely; suggestions such as buying extra hardware, doing extra network segregation, or indicating whether it is common or not to be local admin does not answer my question.