Again, how would you get the mandatory profile file onto the work machine? re-enforcing my original point, if the USBs ports are open, or email attachments aren

Again, how would you get the mandatory profile file onto the work machine? re-enforcing my original point, if the USBs ports are open, or email attachments aren't being filtered, you've blown your desktop security anyway. I did this stuff as my job for 10 years. Windows XP was like swiss cheese, Windows 7 was much better, and now Windows 10 is rock solid; if you go all out on the security settings, an average user cannot break in or elevate themselves.