in macOS, even if you run as admin, the only thing that gives you is `sudo` access. Your "admin" user still is a normal user, but it's allowed to gain elevated privileges by supplying their password (or doing biometric auth).
The only difference between running as an admin and not running as an admin is that in the former case you don't have to type in your user name.
>having to elevate to an admin account in order to "download anything" would be a nightmare for any substantial IT department to support
normal users can download all they want. They can't execute it though. That's absolutely what I would like my machine to be configured as.
Who disagrees with that? For most users, by a long shot, installing software is only a tiny fraction of the tasks they perform.
Anybody, including that substantial IT department has to elevate to an admin account to install software, and that is a good thing.
Any halfway smart IT department won’t have to type an admin password on every machine or even visit every machine, though.
> Most consumer laptops and PCs I've seen (and I've seen a lot) don't even have a non-admin user account setup.
Have you ever used macOS or are you basing this on Windows laptops?
Accounts ought to be granted privileges based on the user's need to get things done.
Most consumer laptops and PCs I've seen (and I've seen a lot) don't even have a non-admin user account setup.