The middle way between to little and to much breathing room is kinda easy.
All my laptop user are local admins. They either have no access to the compay network or they are told that if anything happens that I do not like or is illegal (like kazaa, Emule, games (legal or not) or just one illegal MP3 or something like it) they will get a clean image restored by me no questions asked and local admin rights are gone. Nothing gets saved all is clean and crisp. This way they will learn the hard way. The are aware of this policy and some are bitten by it already. You should se the faces when they are caught. Priceless 
Begging on knees to get local admin back but justice for all and all for justice. Yes this is a kinda harsh but my users will just not listen otherwise.
All offending laptop users will get a 3 month trial period and after that they will get local admin rights restored until they screw up again.
_________________________
Mart
- Chuck Norris once sold ebay to ebay on ebay.
