I have been a fan of honey pots since the 80's. However, there is a converse that may appear in your shop internally.
Back in the VAX/VMS days, a co-worker (for grins only) went to each terminal and started a program that acted like the login screen, stored user name and password, and logged out. With only a casual early morning glance the user thought he had started the day hitting the wrong key.
Lemon Pots can collect all of an admin's keys if they do not secure their machines.
Keep Up with TechRepublic