If a user has physical access to a machine, she owns it. I haven't seen anyone mention this amid talk of locking down systems. Let me elaborate:
No root access? Boot to single user, reset root password. You own it.
No root access and BIOS password? (varies by platform) Pull motherboard battery/modify amount of RAM (iBook, all Macs?)/remove jumper (most enterprisey Dells). Boot to single user, reset root password. You own it.
If people have desktops, as in machines on their desks and in their offices well then they own these machines.