Originally posted here by securlynn
why do you allow users to be admins of their own box?

I have to work within the system here. If I was an executive, maybe I could pound my fist and demand it. I've told everyone within earshot and all I get is lip service. It's a cultural change and not a technolocy change; the hardest kind!
Unfortunately, securlynn is in a situation all too common in our industry. She has no real control over policy, or not a lot. Suggestions, statements of best practice, etc. But at the end of the day, if a manager says 'do it this way', you can argue, and disagree, and not do it...but you'll probably be disciplined and could even lose your job.

It's easy to sit in a perch of academia and say "That violates the principles of least priviledge and best practice. You are condemned as a moron until your environment complies with our ideals." Hehe, I'm not accusing you guys of this, just having a little fun. But the point is there is only so much one can do, sometimes. That's when you get to be very good at CYA. Document everything, make recommendations (via email, and save your .PST files if your an outlook user), and acknowledge the denials for your requests...and SAVE THEM.

It's saved my @ss more than once.