The risk for us is more one of uncertified tools. People using stuff like Dropbox which we don't have a data processing agreement with. Or stuff like TeamViewer.

Locking down admin rights is not just to lock down the OS but to ensure security restrictions aren't easily circumvented.

For the files we use AIP which protects against copying. You can't open those in a personal machine for example.