We have a staff small ads system and so the favourite trick on the shop floor is to place a nonsense advert using the unlocked workstation such as Wanted - Braincell.

This then results in the user getting emails and a call from the system administrators who monitor adverts!

Most users other than admins cannot write to the C drive and USB and other ports and cd/dvd drives are locked down on our systems so can't be used and can only be opened up to specially encrypted memory sticks. This stops anything being brought in from outside or being installed by non-admin staff. It's not rocket science and I'm surprised it's not industry standard practice.