You create a domain user named User1. The domain user are member of the local groups on each client computer as described in the following: You plan to configure client Push installation. You need…

User3's group memberships are not described as providing the appropriate scope or least-privilege level needed for client push across the target client computers.

Specifying a user as OU manager grants AD delegation rights, not local administrator rights on client computers, which is the actual requirement for Client Push installation.

Adding User1 to the Client Admins group (a local administrators group on client computers) and then configuring User1 as the Client Push installation account satisfies the requirement by granting the minimum necessary privilege - local administrator rights on the clients - without elevating the account to domain admin or other broader roles. This follows the principle of least privilege while still meeting the technical requirement for client installation.

Configuring User1 directly without first adding them to the Client Admins group would mean User1 lacks the local administrator rights required for Client Push to succeed on the client computers.