I am afraid you are in for a tough fight on this one. A helpdesk tech generally has local administrator permissions on all workstations, not just their own. My take is that you have a couple of options - neither will be agreeable to everyong. Option one, remove their local workstation permissions and make them like everyone else (no installing permissions, etc.) If they need local workstation admin permission, give them a special login for them to use (not their personal one). The falicy here is that they may alway login with the special one and rarely use their personal one. Option two is to put a policy in place (with teeth) that forbids unauthorized software installations. The "teeth" would involve some form of HR policy with disciplinary ramifications - this is always a tough sell, even when it's a new company.
