Not basic at all, but should be
This problem is a plague and will not leave any tech forum alone. I can't imagine anyone not ever experiencing it in their career. That may not make you feel better, but at least you know your not alone.
Some things that have NOT worked well for me:
1) Brute force restrictions (because I said so). Hey we were all young a bold (stupid) at some point...right!?!
2) Giving in to user demands (their the boss).
3) ignoring the situation
What has worked:
1) Educate from top down. Much easier to implement restrictions with top level mgmt on board
2) find the users who "get it" and use them as promoters and examples. When people at their own level are singing praises of whatever is being pushed, it will be more widely accepted.
3)Include all the ideas already presented here in other posts for the education portion (cost savings, less downtime, security, legal implications).
I have found a few situations (traveling salesforce) where admin priveleges really help everyone do their job better. I just create a separate local account that can be used in "special cases". I educate them on how/when to use it and make them sign off on a statement regarding policies and procedures for using the laptop, admin account, etc. This is working very well so far (users are happy, I don't get midnight helpdesk calls to install a needed plugin). Oh, I don't put these laptops on the domain either and I restrict their access to domain resources just in case.
Hope this helps. Keep fighting the battle. I do agree, though, that if you cannot get top level support, you should find another job. No matter what, you will be the one made to look bad when the @#@# starts to roll and getting fired something you tried to fix would not be a good situation.
