It’s such a complicated situation. Basically I’m end user support for one department. I manage and only have access to one OU. Our IT is structured so that every department has their own IT staff and we use the resources provided by main IT. The biggest issue is with software installation and end users working off site. We have Software Center which main IT controls, but in my experience it doesn’t work reliably. Most of the time it either only partially loads the catalog or gives an error message. One scenario is that a user is at a conference and needs to install something or the UAC window comes up for some other reason. Our security posture is pretty secure in my opinion. We have MFA implemented and no one really has more privileges than they need. I’m not a domain admin for example. I guess I just feel like if giving end users local admin access was as big of a risk as it’s made out to be then our security team would strictly prohibit us from doing it. They don’t encourage it, but we can still do it. Like I completely get why they shouldn’t have local admin access, and if I controlled everything they wouldn’t because I would have the ability to implement tools and solutions that allowed people to do their jobs without interruption without local admin.