AWS for us is even more locked down. Nobody gets access to that. Unless they sign up with their own account and pay for it themselves perhaps?

But the idea is of course that the applications needed for work are all available in the company software catalog. When we locked this down we did extensive pilots.

As an EU company we have to certify each tool for privacy anyway and we can't allow unvalidated tools (and even worse: cloud services) for this reason. The fines are huge and we have a responsibility to our customers.

Personal machines are explicitly forbidden and not allowed on the network using 802.1x.

The admin rights prevent people from bypassing security controls. Such as disabling the proxy which checks for forbidden services for which we don't have a data processing agreement, like Dropbox.

I know it's not easy. But letting people do what they please is causing the kinds of data leaks we're seeing in the media almost every day.

I agree some things are a step too far and inevitably drive people into shadow IT but admin rights are pretty low hanging fruit these days.

And really, since we did this the company is still running :)