In our environment, we want all users to run as standard users on Mac. What's the best way of doing this as part of the setup experience? So far, my general thoughts are to just do it as a script to deploy a local admin user, then bump their account down to standard once the script has run, but I'm wondering if there are alternatives/better ways?

Hi @Rupert the Mac Goblin! Your plan sounds fairly sound to me!