I'd say if you are targeting a very specific platform, developers don't really need full admin access to do their jobs. e.g. ASP.NET development is fairly rigid and it's usually done with the whole team using the same exact tools (Visual Studio, TFS, etc). In such a regimented environment, it might be better to lock everything down. But in an agency or consultancy shop, the tool set could change with every project. I don't think IT should be on the hook for setting up random systems that will only be used for a few months or weeks before being torn down again.