Remove users from local admin

In case you will bind the computers to AD via PreStage Enrollment or the Bind Policy you can set up the AD users as Non-Admins. But in this case you have export and migrate the existing userfolders. Maybe a slow transistion works for you. Let the users be local admins as long as you dont reinstall their machines. Tell the users in advance that with the next Systemrollout will loose their higher privilleges but with Jamf Pro everything will be easier for them. I did such transistions this way...if I have a problem with a client I will reinstall it (including Backup via CCC), perfom a new enrollment to Jamf Pro and with this a new bind to AD. Clean install, new versions of the software and mostly a happy user. On bigger Software updates like OS 11.3 I would setup appointments with groups of users to force the reinstallment a little bit. But that depends a little bit on the size of the company and the number of IT personell. For the developers you can create a hidden user with Jamf Pro (local). I would set it up as create on login and delete on log off - that makes sure no one else can login with this hidden account.

I have a script for granting admin rights based on AD group, this isn't the full code, but it should get you close to what you are looking for. One of the catches is that the user needs to have a kerberos ticket in order for a search against the AD, to aid in ensuring this is the case we configure and deploy NoMAD (https://nomad.menu). You could do an initial loop to revoke admin rights for all users and then use something like this code to add the admin rights for the chosen user based on the AD group membership.
.

User_Name=`ls -l /dev/console | awk '{print $3}'`

Computer_Name=`/usr/sbin/scutil --get ComputerName | tr '[:upper:]' '[:lower:]'`

User_UID=`id -u $User_Name`

# Change Auth_User to use python to call the klist command (launchctl asuser $User_UID klist -s) wasn't working natively in the shell.
Auth_User=$(python - <<EOF
import subprocess
import os
try:
    subprocess.check_call(['launchctl', 'asuser', str($User_UID), 'klist', '-s'])
    print "$User_Name@ED.AC.UK
"
except subprocess.CalledProcessError:
    print "False
"
EOF
)

if [ "$Auth_User" == "False" ];
then
    exit 255; # No Kerberos ticket.
fi

Admin_Users=( `launchctl asuser $User_UID ldapsearch -b"ou=Auth,ou=UoE,dc=ed,dc=ac,dc=uk" -H "ldap://${Domain_Controller}.ed.ac.uk" "(cn=${Computer_Name}_Admin)" member | grep "member:" | awk -F "CN=" '{print $2}' | awk -F "," '{print $1}' `)

Who_is_Admin=`dscl . -read /Groups/admin GroupMembership`

# Apply admin rights
for AD_User in ${Admin_Users[@]}
do
    # Is there a local account with the uun name
    UUN_Present=`dscl . -list /Users | grep $AD_User`
    # check the local username matches the UUN or that the UUN is present in the local node.
    if  [ "${User_Name}@ED.AC.UK" == "$Auth_User" ] || [ "$AD_User" == "$UUN_Present" ];
    then
        echo checking if admin rights need added
        Admin_Exists=`echo $Who_is_Admin | tr " " "
" | grep $AD_User` 
        if ! [ "$Admin_Exists" == "$AD_User" ];
        then
            /usr/sbin/dseditgroup -o edit -a $AD_User -t user admin
            echo adding admin rights for $AD_User 
        fi
    fi
done

User_Name=`ls -l /dev/console | awk '{print $3}'`

Computer_Name=`/usr/sbin/scutil --get ComputerName | tr '[:upper:]' '[:lower:]'`

User_UID=`id -u $User_Name`

# Change Auth_User to use python to call the klist command (launchctl asuser $User_UID klist -s) wasn't working natively in the shell.
Auth_User=$(python - <<EOF
import subprocess
import os
try:
    subprocess.check_call(['launchctl', 'asuser', str($User_UID), 'klist', '-s'])
    print "$User_Name@ED.AC.UK
"
except subprocess.CalledProcessError:
    print "False
"
EOF
)

if [ "$Auth_User" == "False" ];
then
    exit 255; # No Kerberos ticket.
fi

Admin_Users=( `launchctl asuser $User_UID ldapsearch -b"ou=Auth,ou=UoE,dc=ed,dc=ac,dc=uk" -H "ldap://${Domain_Controller}.ed.ac.uk" "(cn=${Computer_Name}_Admin)" member | grep "member:" | awk -F "CN=" '{print $2}' | awk -F "," '{print $1}' `)

Who_is_Admin=`dscl . -read /Groups/admin GroupMembership`

# Apply admin rights
for AD_User in ${Admin_Users[@]}
do
    # Is there a local account with the uun name
    UUN_Present=`dscl . -list /Users | grep $AD_User`
    # check the local username matches the UUN or that the UUN is present in the local node.
    if  [ "${User_Name}@ED.AC.UK" == "$Auth_User" ] || [ "$AD_User" == "$UUN_Present" ];
    then
        echo checking if admin rights need added
        Admin_Exists=`echo $Who_is_Admin | tr " " "
" | grep $AD_User` 
        if ! [ "$Admin_Exists" == "$AD_User" ];
        then
            /usr/sbin/dseditgroup -o edit -a $AD_User -t user admin
            echo adding admin rights for $AD_User 
        fi
    fi
done

Could you please the steps to do test