So a specialized setup, no different than typical IT setups that most Windows shops already have in place with AD, policy groups and hardware assisted sandboxing.

And completely out of reach as the typical setup most people buy for their homes.