I fail to see the fundamental difference with Linux you're talking about. Typically adding a user to the sudo/wheel group mean precisely that they can run whate

I fail to see the fundamental difference with Linux you're talking about. Typically adding a user to the sudo/wheel group mean precisely that they can run whatever as the superuser (root). Once you're root, Bob's your uncle. Sure you can tweak it to only allow certain commands, restrict it to another group, etc. Which would be equivalant to, in Windows, probably using another group(s) than Administrators and assign privilegas as appopriate. I have a lot of unfavorable opinions of security fundamentals in Windows but you're barking up the wrong tree here. From your other comment in this thread: > The issue is not that people don't understand how MS defines what is and is not a security boundary. With all due respect, check your assumptions...