[Spooky23]

It's a no-brainer decision from a security point of view.

The only exception that I would consider would be allowing for remote virtual desktop or virtual app access. Even that has risks that needs to be considered.

Remember that with BYO, unless you're providing stipends for employees to buy equipment with string attached, you're not dealing with just your employee -- you're potentially thinking about the employee's extended circle of associates. The employee's kid, parent, drunk roommate, etc all have access.

[xcq1]

The VPN access works over remote desktop. Should've probably made that clearer from the start.

I don't know if this is specific to here, but you'd have to toggle the VPN explicitly on and off and with another password, separate from your user account. Along with the usual drill to have another password to access the machine and lock it when you're away. I agree it ultimately comes down to trust however.