Yes... Now that I think about it you should have a admin 'role' or group
that a user must belong to in order to have the default set of mundane
desktop administrative tasks.
Things like 'mount removable media', 'reboot', 'update software' and a few
Then let the initial account created during installation belong to this
role. Then users that get added later it should be a manual task to add
these 'mundane privileges' through adding them through a role.
Then the first time that a user performs a mundane privilege then it should
prompt them to if they want to make a 'desktop admin' password or not.