Oh yeah trust me, I have a system of catching hackers because anytime you give a teenager all the time in the world, Google, and their laptop off campus, they will eventually find away around your security. I have a script that checks for admin membership and if so flags the system for abuse. It is impossible to stop someone with physical access, but it is very possible to play detective and catch those who hack machines.

We actually give all our staff local admin accounts anyway. So they have admin rights to their machines, we just don't make their account an admin so they aren't always logged in as an admin. Some directors and stuff are just plain stand alone machines, which aren't even imaged or bound to server. We just load the Casper client on them so they can get software.

I just don't like the concept of temporary admin rights. I think either the user needs it, or they don't. That is all. Thanks for the tip.