User-Installed Software

The three objectives are a policy, a control, and a monitor, and removing admin rights is only the middle one.

Objective [a] wants a written policy on software installation by users, [b] wants the control that enforces it, and [c] wants monitoring that would catch what slipped through. Standard users without local administrator rights satisfy [b] and nothing else.

Monitoring is required even when installation is impossible.

The question to answer is how you know users installed nothing if you never look. A recurring software inventory report compared against the approved software list answers it, and an empty result is itself the evidence of monitoring under [c].

Reconcile discoveries against change control.

New software found by the inventory tool is either matched to an approval or investigated. Document what happens when unauthorized software appears: who investigates, how it is removed, and where the outcome is recorded.

Developers with local admin are a policy decision, not a violation.

Grant the exception in the policy. Source tools from controlled repositories where you can. Commit to tighter monitoring, with retroactive approval through change control for what gets added. Keep that arrangement off general-user machines, because a compromised developer endpoint is the worst place to find surprise software.