I used to be an NT/Windows admin over hundreds of computers. There was one supervisor who constantly called my techs to fix her computer after she corrupted it. Problem was she downloaded crap from the internet over and over again, mostly from attaching devices from home. I gave orders to lock it down, no USB, DVD or floppy external access. We already had filters on direct Internet access. Then she had someone revert the changes, and infected her machine again. This went on for a year before she left. Unfortunately, we were a no Apple allowed shop, sigh...
Ever tried to join a Mac to an AD domain?
Before I retired, I worked at a major bank. Every computer was completely locked down - you couldn’t even listen to a music CD. We had automated processes scanning all the computer on the network; if you weren’t locked down, then you got locked down!