EPM Windows - Admin removal and reporting

Hello! I see that EPM Windows does not have option to remove local admin users . There is an idea created 4 years ago. Also, available reporting is limited i.e. who has admin access - I believe this report is based on user login. We are working on removing admin rights from users who had exception requests and finding it difficult to provide reliable evidence which is easy to generate from within a console - currently relying on multiple tools such as scripts for VPN, internal network computers, SCCM and PRA for computers not currently connected to internal network etc. I see we can trigger powershell scripts using EPM  based on certain events e.g. Creating rule to launch the script when certain known application like MS edge update is run.
  Just want to check how others are handling such scenarios