How can it be proven that users cannot install software to their local machine without having local-admin privileges?
The system owners are able to view the GPO and show that the only groups with access to BUILTIN\Administrators are
domain\Domain Admins and
domain\CustomAdminGroup, but are unable to provide any evidence that the ability to install software is restricted to that group. Is there a configuration that enforces this restriction or a configuration that says the corollary (non local admins cannot install software)?
Alternatively, is there documentation from Microsoft that says
Software installation privileges are inherently only available to the Local Administrators?