[CarmichaelPatriot]

Yes, but if a virus wants to install itself on a Mac, it has to ask the user to type in the administrative password. Many of them do, since they’re not skilled Unix system administrators.

A problem that is easily solved by not giving end users administrator access.

[proxy_user]

Depends on how tightly you want to control the corporate environment. If you allow people to connect the devices they personally own to the corporate network, then you can’t have this kind of control. If you say they must use a locked-down, corporate-issued computer, employees will get upset over not being able to install software and otherwise do whatever they want.