UltraVNC

Thanks for your answer!

They can change the local and remote registry of every PC
No, because of various policies and the disabled "file- and printersharing" a user can't edit the registry remotly.

What local admin rights does the users need, does they need to install there own services ...

If you can use the service manager, you can remote install/uninstall vnc, this users HAVE ALWAYS ACCESS.
No need to block them, because they always can grant themself access.

Hi,

nevertheless I would like to have an option to disallow the local admins to connect to VNC.

Why? Because we have PCs ...