We give our people who have reasonable need Local Admin. Giving local admin to the non-technical staff who want to download 'free' software (not FLOSS, free as

We give our people who have reasonable need Local Admin. Giving local admin to the non-technical staff who want to download 'free' software (not FLOSS, free as in beer) because they think (at best) that they are saving the company money, but instead infest their computer malware. Most people are totally disinterested in their computing environment, let alone managing it. We standardise on certain packages because there is utility in having common programs from support, training, and administration points of view, but ultimately if there is a good reason to get/use something else, we will do that. Furthermore, any user with a local admin access can use a Kerberos 'Golden Ticket' leverage attack to gain full domain access across the entire realm. Are you seriously telling me that you want the teller at your bank to have local admin access to his workstation? How about the person at the IRS/CRA/HMRC/<you government tax office> that you just called? Local admin has its place, and certainly the first test is that will the person endanger their system by running dubious programs. The next question is if that person does infect their system, can they clean up the mess themselves? We went from a situation where we had local admin across our estate where we had at least one virus problem a week to one where I can not remember the last time we had one. Finally, can you really trust a Windows workstation after it has had an infection?