Blanket local admin privs to users across an organization

The subject of this post was the subject of a discussion in a group today.

Imagine a (let's say 10,000+ endpoint) fictitious organization where all users have local admin on their Windows devices.

I said it's a terrible idea. A colleague disagreed, saying that security needs to be a balance and maybe the users needed it for configuring some apps (or whatever reason). He then conceded that maybe only some departments should be given local admin rights. I disagreed and …

cybersecurity local