My question is how do you secure it?

Currently I have an exe file (I converted a bat file and encrypted it) that starts the script that needs admin rights. My worry is some smart user or anyone who knows a little bit about scripting will figure out that the exe launches a script which has admin rights, domain admin at that. This person could then edit or create another script named the same as the one I'm launching and execute whatever they wanted with admin rights.

Is there a way to set up permissions so that a normal user can execute a file on a remote share but... cannot copy or read that file?

Thanks