> Being local admin on the workstation doesn't really give you any more ability to do damage than just a regular user account That's dangerously untrue. On all

> Being local admin on the workstation doesn't really give you any more ability to do damage than just a regular user account That's dangerously untrue. On all the Windows systems at home, everybody else is a non-privileged user and I set sane file permissions so they can get to shared movies, etc, but not read my bank details and tax records. Privilege escalation means that they could trivially change those permissions. The same is true of a corporate environment -- just because you can't also make changes to AD doesn't mean the threat of accessing local files under other users' accounts is trivial. ETA: I just read a bunch of this user's other posts in this thread and I'm beginning to suspect they're trolling, so I'll disengage.