Giving a user as few privileges as possible tends to cause some aggravation by the user, but by the same token it also removes a lot of easily preventable infection vectors. Still, sometimes users need to have local admin rights in order to troubleshoot issues- especially if they’re on the road with a laptop. Therefore, creating a local admin account may sometimes be the most effective way to keep these privileges separate.