Local administrator rights
Full control over a single computer, which is enough for most malware to do everything it needs.
Handing every user local admin on their own machine is common and quietly expensive. It means any malicious code they run inherits full control of that device, can disable security tooling, and can dump credentials from memory.
Removing it is one of the highest-value changes available and one of the least popular. The workable version pairs removal with a fast, low-friction way to get elevation approved when it is genuinely needed, so people are not left blocked.
Where this comes up
Local administrator rights sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.