Performing maintenance and keeping your network up to date can be a nightmare. With hundreds of users, trying to run a help desk, stay in compliance, checking logs, getting updates and service packs and doing a ton of other administrative tasks can be overwhelming for any information department.
Generally most administrators lock down every user to a point that the user cannot make any corrections without a technician available. Although your policy and procedures may require a technician to service a computer, it is generally acceptable to let the user make corrections to their system when possible. You can still maintain security and control of each computer.