I was arguing with my colleague about this topic. There are two main question:
As I know, windows will request for admin rights if we are installing some desktop app for all users.
If a user doesn't have admin rights, he won't able to modify files which admin created. So, a simple user aren't able to update an app that was installed for all users.
Am I wrong? If we want to install an app that will be for all users, do we exactly need admin rights?
You cannot install apps for all users without certain write privileges since you generally need to modify %ProgramFiles%, the "common" start menu and HKEY_LOCAL_MACHINE to install an app. A normal user cannot write to these locations. A member of the now deprecated power-users group can install most applications for all users even though they are not a full administrator unless the installer specifically checks for administrator rights.
A non-admin user can however install patches to an app installed for all users if the .MSI is signed, this is called User Account Control (UAC) Patching.
Chrome and Firefox use an alternative approach with a Windows service and scheduled tasks. This also requires an administrator to perform the initial installation.