like told...
build a system which was locked down.
it only runs automatically the terminal software to connect to mainframe.
and it allows no other executable run by user.

this far, no user has made up a way around it ( I know some simple ones though...)
that' is proven by their bleed for word and excel access on the computer.

anyway, locked down system is locked down as far as the local admin passwd is lccked.
with locked down by ignorance I have ran a single wksta with not a single user getting a way around it during this 1-1,5 year test.

I think it's fair to say:
if you think your admin pass is secure, so is properly locked down nt-wksta... or even better
_________________________
!

download KiXnet