Replies

My employer has a very simple policy on this sort of thing. All users have User rights, but not admin rights. The machines are otherwise open.

Once a week an automated process pulls the user data from the Documents & Settings folder plus one predesignated user data folder, wipes the disk, and reloads the "approved" image. The process can also be activated at random intervals if worms or other security threats are detected and IT wants to ensure that the network is "clean". Also, if you call the helpdesk for support the FIRST thing they usually do is a remote reload of your computer to ensure that it's not a corruption or unauthorized software issue (takes about 15 minutes).

New employees often sit down on their computers and start customizing right away, but that usually comes to an end after the second or third week when they get tired of loading the same software over and over. If it's needed for their job, we have a simple process where IT reviews the program and will begin including it if it is "safe". We don't have IT Nazi's here, and they'll approve pretty much anything as long as the requester can show that it's work related, properly licensed, and that it will not negatively affect the computer or network.

It's not a bad system. Users have the flexibility to customize their computer if needed for a specific project, and IT has managed to get our desktops fairly well standardized. It did require an investment in gigabit ethernet to the desktop to acquire the bandwidth needed to make the system work reasonably quickly, but the time savings for them has already paid for it.