> a relatively hostile setup without even local admin rights Taking a diversion into this -- how about local admin rights to a virtual VM / sandboxed machine?

> a relatively hostile setup without even local admin rights Taking a diversion into this -- how about local admin rights to a virtual VM / sandboxed machine? I imagine that would allow developers to be productive, while protecting everything that IT wants to protect. Once you do that, I imagine everyone will discover the issue isn't actually _local_ admin rights, but having admin rights to a machine that's on the internal network and can access internal company resources. Which might mean that IT has taken a strategy that once you're inside the local network, you have access to lots of valuable goodies. Which is a scary strategy.