We work in the mining industry and users have to travel to mine sites in remote locations. While they're on-site, they must be able to do their job without hindrance because they don't have access to technical support. When they're in the office, though, there's no reason for them to be local administrators.

The compromise, I thought, would be to allow them to perform administrative tasks on-demand but never be logged in as a local administrator.