Had mine replaced a couple months ago, they still wanted access. I'm pretty sure they gave a good reason,but I forgot. Probably just to run diagnostics. I made them an account. Still not ideal but I think they could just boot in single user mode and give themselves one if they wanted to.