So, here's my conundrum.
I have about 500 pc's out in the field that aren't on a domain (yep, I know. I didn't set up the network) and I'm trying to manage them via InTune. These computers are all horribly out of date (the old SA turned off windows update and installed deep freeze) so the computers were "somewhat" safe in terms getting viruses / malware infections. (Not really, but for the sake of speeding this along and getting to the point...)
Going forward I want to remove Deep Freeze and rely on a more robust system of updates, active virus / malware removal, and patches. That said, I'm a little stuck on how to go about doing this.
The accounts on these machines are set as local administrators without any limitations on their install / uninstall rights. I am in the process of deploying intune to each of these computers.
My Question: What would be the "best" (see: most effective way) to disable end-user installs, while still being able to distribute software / updates via InTune.
Any help with this would be greatly appreciated.