hello

Today in our environment our linux machines are managed only by automox. Linux machines do not query Active Directory and all linux users are adm of the machines.
It turns out that a demand arose to remove users' privileges, making them standard users and without adm privileges.
The problem is that to do this we would have to change the account type, have a local user with adm privileges and rotating password in the LAPS style and somehow block the machine from being formatted, all using automox.
Would any good soul have a solution for this?