Looking at a lot of different security software on Windows, a lot of them rely on some settings on the computer which can probably be overridden by a local administrator.
For eg. some DLP software does some settings which prevents a user from using a USB drive. However, I think a local admin can always override this? A whitelisting product depends on a whitelist which is signed by a trusted source. However, the product's truststore is probably stored somewhere locally, so you can probably add a trust certificate and add a list signed by your own cert.
So the question here is - these products can prevent accidental misuse - but can they really protect a malicious local admin? Are there any settings which can be set at a domain level on Windows which restrict permissions on a local admin and make it a little more difficult?