From what I've experienced, most holes in the system that would allow that are problems with management policy. We've been lucky here in that we haven't had any cases of a disgruntled employee raising a little hell when they leave, and most folks here have the knowledge to do it -- it's a tech support company. In the last 6 months, we've finally been able to convince managers to let us at LEAST fill in some basic security holes. Prior to this, for example: - Every user was given the same password on a new account, with no forced change or expiry - Accounts were left active (with VPN access) for one month after termination, "just in case" - Every user is added to the local administrator group on their machine - No BIOS lockdown (I've had users building their own machine images) Most of us that were getting annoyed were a result of fixing other random issues that arose from above... People installing BitTorrent and Limewire and work and hammering the firewall with them can be a bit of an issue. Thankfully, we've had some management changes. All it took was for us to sit with the new managers, explain the issues, and most importantly, WHY these are problems. Most managers don't have the technical knowledge to understand why certain problems are problems, and most technicians don't have the ability (or patience) to talk to a manager at a level they can understand.