Honestly, the whole concept of locked down machines makes no sense to me. If you don't trust your employees, why did you hire them? Let them configure their own machines and secure the edge network and physical premesis. Happy employees won't steal from you, and they'll be motivated to protect their workstations so they can keep their job.
I just... don't understand any of it, and refuse to work anywhere that doesn't give me admin/root access to my work machine. Just let me do my job and you'll be happier with my performance...