Yes, only administartors should be allowed to do this. With MSI Installers you can use AlwaysInstallElevated to enforce this. Also, implement policies form the very beginning. It'll make hardening the workstations much easier.
_________________________
There are two types of vessels, submarines and targets.
