I worked at a research organization with about 120 people. Only about 30 could do their work with a locked down machine, the other 90 were researchers or technologists who had to use obscure software and many of them had to work in remote locations where the only help we could give them was over the phone (i.e. no Remote Desktop to their laptop to make something work).
While it's true that "Most decent modern software no longer requires admin rights," we had to deal with a lot of not-quite-decent apps that needed admin to install and run. Some of it was software written in-house or by other researchers and grad students that was needed because of its scientific accuracy, not the quality of the software or its adherence to best practices.
Some of it was software used for data acquisition and process control that was intended to run on a dedicated machine in an industrial setting. In that setting, even if someone gets out of the control app, they have to immediately start it up again because some big, dangerous piece of equipment is dependent on it. But when those apps were used in our environment, they weren't the only thing running on that PC.
We also had a corporate culture where anything the scientists needed to do was ok and IT had to make it work. Back when it was Win3.1, 95, 98 it didn't natter, but as soon as we got into NT4 Workstation, we had to start dealing with Admin or not.
We (barely) dealt with the situation using a variety of workarounds, combined differently for each situation:
For the industrial control apps used in our labs, RunAs usually worked. The senior techs would have the pw for an account with local admin rights and they'd be the ones that started up the apps for the other technologists.
For some scientists, we gave them local accounts on their PCs that had admin access. If they needed to install something, they could log out from the network, log in locally and install, then log out again and back in to the network. Or they'd use RunAs. None of them liked doing this, but almost every one of them had killed a computer to the point that it needed re-staging, so they put up with it.
None of these obscure programs could be installed with Group Policy, but we spent a lot of time building up ghost images and making sure data was backed up so that it wouldn't take much time to wipe and reinstall a machine that was having problems.
In some cases, we put the machines with problematic software on a restricted VLAN, but as mentioned, the problem with that is that they often needed to access the main corporate network even when they're running as admin
For one department, we gave everyone 2 machines for a while - one locked down, one with admin access. That lasted a year until they all got fed up with not having all their tools on their "main" office PC.
For some of the scientists who only needed admin access once in a while, we'd set up accounts that had admin rights but with crazy long passwords. When they needed access, we'd tell them the password knowing that they'd never remember or even bother writing it down.
We were starting to look at VMs when I left - give them VMWare Workstation or Player and a couple different VMs that they had admin access to. This is what I'd focus on if I were ever in a similar situation again.
