I am looking for possible solutions to prevent local administration privileges for our domain users. Currently, we provide our domain users local administration privileges to avoid issues with different applications. Some applications will not start or work correctly without local administrator privileges.
Now I am interested in the current state of the technologies or best practices to avoid those kinds of permission. For example, we would like to restrict the local permissions and forbid the installation and execution of untrusted applications.
I've found the Software Restriction Policies and AppLocker as well as MDOP from Microsoft.
Which technologies and best practices could you recommend?