[tx_eggman]

Here at the BIG International PetroChemical Company ® over 90% of the users have locked machines. They can't even create a text file on their C drive unless it's in a folder unlocked by a software installation script.

If a desktop goes bad it can be reimaged in about an hour.

Acquiring an unlocked machine requires and act of God.

[ShadowAce]

There is a way of allowing users to have unlocked machines and still be able to fix their mistakes.

Have each user log into a thin client that looks and feels like a real machine. If something goes wrong, simply restore the machine image on the server.

This has been done using a *nix-based OS on the clients, running a VM from the server. If the virtual client goes bad, merely copy that machine's image from a backup file.

Usually, the users don't even know they're on a thin client.

[proxy_user]

"Acquiring an unlocked machine requires and act of God.

Or maybe a quick perusal of a couple of articles from 2600.

It is really very difficult to stop a privilege escalation attack if the user has an account on a box, particularly a Windows box.