Doesn't have to be, invariably is in my experience. I prefer the approach of taking the phrase Zero Trust literally.
- Ensure full disk encryption
- Time limit on how long people can defer OS upgrades
- Report on software installed and versions
- Enforce somewhat complex password
- Enforce password after screen has become locked
- Allow us to remote wipe the machine if lost/stolen
It didn't stop you from installing / uninstalling anything - even itself. Although if your machine stopped phoning home for a certain amount of time we had some alerts set up for the IT support team to follow up.