Most owners know they should remove local admin rights from staff laptops. What stops them is the fear of the Monday morning after: printers that will not install, a finance app that needs an update, a designer who cannot add a font. Done badly, removing admin rights creates a ticket flood and a quiet rollback. Done in the right order, with Intune doing the heavy lifting, most users never notice.
This is the sequence I use with 20-500 person businesses to take users from administrator to standard user without drowning the help desk.
Why admin rights matter more than most controls
When a user runs as a local administrator, any malware they launch also runs as a local administrator. It can turn off protections, install persistence, dump credentials and spread. When the same user runs as a standard user, a large share of that malware simply fails or is contained to the user’s profile.
Admin rights also make your other controls weaker. A user with admin rights can uninstall agents, change firewall settings and install unapproved software. Every policy you build in Intune assumes the user cannot undo it. Removing admin rights is what makes that assumption true.
Step 1: Find out who has admin today
You cannot plan the change until you know the scope. In the environments I review there are usually three sources of admin rights:
Autopilot or setup choices. If devices were enrolled with the primary user as an administrator, every user who set up their own laptop is an admin.
Entra ID device settings. The setting that adds the registering user to the local administrators group on Entra joined devices, plus any global or device administrator roles.
Manual additions. A technician added someone to the Administrators group to fix a problem years ago and never removed them.
Check each one. In the Entra admin center, review Entra ID > Devices > Device settings for the local administrator options. In Intune, review your Windows Autopilot deployment profiles for the User account type setting. For manual additions, a simple remediation script or Defender for Endpoint advanced hunting can list members of the local Administrators group across devices.
Step 2: Fix the reasons people need admin
Users do not want admin rights for fun. They want them because something in their week needs them. Remove those reasons before you remove the rights.
Move app installs to Company Portal
The biggest source of admin requests is software installs. Package the apps people actually use as Win32 or Microsoft Store apps in Intune and publish them as Available in Company Portal. Users install them on demand, Intune runs the install as system, and nobody needs admin. Start with the apps from your last six months of tickets.
Handle printers and drivers
Printer installs are the second biggest source. Deploy printers through Universal Print or a packaged driver, and use Windows Update for driver updates through Intune update policies.
Keep apps updated without users
Apps that self-update with an admin prompt are a classic complaint. Microsoft 365 Apps update themselves. For third-party apps, use Intune app supersedence or a patching tool so users are not asked for credentials they do not have.
Step 3: Use Endpoint Privilege Management for the real exceptions
After Steps 1 and 2 there will still be a small set of genuine needs: a developer tool, a vendor diagnostics utility, a legacy line-of-business app that writes to Program Files. This is where Intune Endpoint Privilege Management (EPM) earns its place.
EPM lets a standard user run a specific, approved file with elevated rights without giving them admin over the whole device. You define elevation rules in Intune, and each rule identifies a file by hash or by publisher certificate plus other attributes. EPM is an Intune add-on, licensed on its own or as part of the Microsoft Intune Suite, and it applies to Windows devices only.
EPM supports several elevation types:
Elevation type
What the user sees
Good for
Automatic
Nothing. The approved file elevates silently.
Trusted tools used daily by a known group.
User confirmed
A prompt, optionally with business justification or Windows sign-in.
Tools that are fine but should leave an audit trail.
Support approved
A request that IT approves in the Intune admin center.
Rare, one-off needs.
Deny
The file cannot run elevated.
Known risky tools.
The best part is the reporting. EPM shows unmanaged elevations, meaning every time someone who still has admin uses Run as administrator. Run EPM reporting for two to four weeks before you remove rights and you get a real list of what people elevate, instead of guessing. You can create rules straight from that report under Endpoint security > Endpoint Privilege Management > Reports.
Two rule-writing habits matter. Prefer file hash or certificate plus product details over file names, since file names are easy to change. And where you use a file path, point it at a location standard users cannot write to.
Step 4: Remove the rights in waves
Now take the rights away, but in rings rather than all at once:
IT and a few volunteers. One week. Fix anything that breaks.
One friendly department. Usually operations or admin staff with a predictable app set.
Everyone else, except a short exception list you review monthly.
The removal itself has two parts. For new devices, set the Autopilot profile’s user account type to Standard so nobody becomes admin at setup. For existing devices, use an Intune Account protection policy with the Local user group membership profile to control who sits in the local Administrators group. Configure it to replace the membership with only your approved admin accounts, and pair it with Windows LAPS so your technicians still have a managed local admin when they need it.
Test the group membership policy on the pilot ring first. Replacing the Administrators group on the wrong devices is the fastest way to lock out the help desk.
Step 5: Tell people before it happens
Most of the ticket flood is surprise, not breakage. Send a short note a week ahead to each wave:
What is changing and why, in one paragraph.
Where to install software now (Company Portal).
What to do if something does not work, and the expected response time.
Brief team leads separately. If managers understand the reason, they defend the change instead of escalating every complaint.
A checklist for the week before removal
Top requested apps are in Company Portal and tested.
Printers deploy without user interaction.
EPM rules exist for the tools found in the elevation report (if licensed).
Windows LAPS is deployed so IT has a managed local admin on every device.
Pilot ring has run as standard users for at least a week.
Help desk has a short script for common requests.
An exception process exists and has an owner.
If you would like help planning the rollout, our Intune managed service handles app packaging, EPM rules and the staged rollout. For the wider device picture, see our endpoint security baseline work, which treats admin rights as one part of a hardened Windows build. An Intune health check is a good first step if you are not sure where your devices stand.
Do I need Endpoint Privilege Management to remove local admin rights?
No. Many businesses remove admin rights with Company Portal, good app packaging and a short exception list. EPM makes the remaining exceptions safer and gives you reporting, but it is an add-on license on top of Intune.
How do I remove admin rights from existing devices with Intune?
Use an Account protection policy with the Local user group membership profile to set who is in the local Administrators group, and set new Autopilot profiles to create standard users. Pilot both before a wide rollout.
Will users still be able to install software?
Yes, from Company Portal. Apps you publish as available install under the system context, so users get what they need without admin rights.
Want to know how many of your users are still local admins? Start with a free Microsoft 365 security assessment and we will map your admin exposure and the fastest safe way to remove it.
Most owners know they should remove local admin rights from staff laptops. What stops them is the fear of the Monday morning after: printers that will not install, a finance app that needs an update, a designer who cannot add a font. Done badly, removing admin rights creates a ticket flood and a quiet rollback. Done in the right order, with Intune doing the heavy lifting, most users never notice.
This is the sequence I use with 20-500 person businesses to take users from administrator to standard user without drowning the help desk.
Why admin rights matter more than most controls
When a user runs as a local administrator, any malware they launch also runs as a local administrator. It can turn off protections, install persistence, dump credentials and spread. When the same user runs as a standard user, a large share of that malware simply fails or is contained to the user’s profile.
Admin rights also make your other controls weaker. A user with admin rights can uninstall agents, change firewall settings and install unapproved software. Every policy you build in Intune assumes the user cannot undo it. Removing admin rights is what makes that assumption true.
Step 1: Find out who has admin today
You cannot plan the change until you know the scope. In the environments I review there are usually three sources of admin rights:
Check each one. In the Entra admin center, review
Entra ID > Devices > Device settingsfor the local administrator options. In Intune, review your Windows Autopilot deployment profiles for the User account type setting. For manual additions, a simple remediation script or Defender for Endpoint advanced hunting can list members of the local Administrators group across devices.Step 2: Fix the reasons people need admin
Users do not want admin rights for fun. They want them because something in their week needs them. Remove those reasons before you remove the rights.
Move app installs to Company Portal
The biggest source of admin requests is software installs. Package the apps people actually use as Win32 or Microsoft Store apps in Intune and publish them as Available in Company Portal. Users install them on demand, Intune runs the install as system, and nobody needs admin. Start with the apps from your last six months of tickets.
Handle printers and drivers
Printer installs are the second biggest source. Deploy printers through Universal Print or a packaged driver, and use Windows Update for driver updates through Intune update policies.
Keep apps updated without users
Apps that self-update with an admin prompt are a classic complaint. Microsoft 365 Apps update themselves. For third-party apps, use Intune app supersedence or a patching tool so users are not asked for credentials they do not have.
Step 3: Use Endpoint Privilege Management for the real exceptions
After Steps 1 and 2 there will still be a small set of genuine needs: a developer tool, a vendor diagnostics utility, a legacy line-of-business app that writes to Program Files. This is where Intune Endpoint Privilege Management (EPM) earns its place.
EPM lets a standard user run a specific, approved file with elevated rights without giving them admin over the whole device. You define elevation rules in Intune, and each rule identifies a file by hash or by publisher certificate plus other attributes. EPM is an Intune add-on, licensed on its own or as part of the Microsoft Intune Suite, and it applies to Windows devices only.
EPM supports several elevation types:
The best part is the reporting. EPM shows unmanaged elevations, meaning every time someone who still has admin uses Run as administrator. Run EPM reporting for two to four weeks before you remove rights and you get a real list of what people elevate, instead of guessing. You can create rules straight from that report under
Endpoint security > Endpoint Privilege Management > Reports.Two rule-writing habits matter. Prefer file hash or certificate plus product details over file names, since file names are easy to change. And where you use a file path, point it at a location standard users cannot write to.
Step 4: Remove the rights in waves
Now take the rights away, but in rings rather than all at once:
The removal itself has two parts. For new devices, set the Autopilot profile’s user account type to Standard so nobody becomes admin at setup. For existing devices, use an Intune Account protection policy with the Local user group membership profile to control who sits in the local Administrators group. Configure it to replace the membership with only your approved admin accounts, and pair it with Windows LAPS so your technicians still have a managed local admin when they need it.
Test the group membership policy on the pilot ring first. Replacing the Administrators group on the wrong devices is the fastest way to lock out the help desk.
Step 5: Tell people before it happens
Most of the ticket flood is surprise, not breakage. Send a short note a week ahead to each wave:
Brief team leads separately. If managers understand the reason, they defend the change instead of escalating every complaint.
A checklist for the week before removal
If you would like help planning the rollout, our Intune managed service handles app packaging, EPM rules and the staged rollout. For the wider device picture, see our endpoint security baseline work, which treats admin rights as one part of a hardened Windows build. An Intune health check is a good first step if you are not sure where your devices stand.
Microsoft’s EPM documentation is a good reference for rule types: Use Endpoint Privilege Management with Microsoft Intune.
Frequently asked questions
Do I need Endpoint Privilege Management to remove local admin rights?
No. Many businesses remove admin rights with Company Portal, good app packaging and a short exception list. EPM makes the remaining exceptions safer and gives you reporting, but it is an add-on license on top of Intune.
How do I remove admin rights from existing devices with Intune?
Use an Account protection policy with the Local user group membership profile to set who is in the local Administrators group, and set new Autopilot profiles to create standard users. Pilot both before a wide rollout.
Will users still be able to install software?
Yes, from Company Portal. Apps you publish as available install under the system context, so users get what they need without admin rights.
Want to know how many of your users are still local admins? Start with a free Microsoft 365 security assessment and we will map your admin exposure and the fastest safe way to remove it.