How to configure administrative right at client end for SEPM 14

Hi,

Anyone can suggest me on follwing point that how we can set admin right at client (user machine like laptop, desktop)

1. If users have admin right but we want they can only fire update and scan policy but can not disable the SEP

2. Can we create a password that uses by client only  If user are out of company's network and when he comes in company network only he only can update and scan at his end.

Please provide your valuable comments

Thanks in advance to all.