Windows client is able to run with SYSTEM privileges after installation

We are planning to distribute the defguard client via Microsoft Configuration Manager (MCM) and were faced with a defguard client running in SYSTEM context after the installation. In my opinion this is a major security issue and needs to be circumvented.

**Describe the solution you'd like**
Prevent the start of defguard after successful installation when the running user is SYSTEM.

**Describe alternatives you've considered**
Add an optional MSI parameter i.e. "--no-start" that prevents the installer from starting defguard after successful installation. This would be less safe than my first solution but is probably realized faster.