On my main image for laptops I had initially put the domain group 'mydomain\student' in the local administrators group to expedite the app downloads etc. Now any student can restart and shutdown other students laptop with remote shutdown command. I had to use group policy to remove 'mydomain\student' group from the local administrators group to restrict all students from doing this.
Now on each laptop if a student want to download something the POP up for users account control opens up and asks for admin credentials. I am wondering if I can put 'mydomain\student' group in the local power users group of the laptops to avoid this annoying pop up?. Will the students be able to restart other computers if I put them in local power users group?
Note: my domain is server 2012 ent edition datacenter, All clients have windows 8.1