[ivraatiems]

Typically, workplaces this strict don't allow users to install software on their machines themselves at all.

This whole story still just sounds to me like a huge overreaction. I think we can invent a hypothetical situation where the company's behavior makes sense, or the employee's motives are impure, but I think it's much more likely that they just got scared and were rash and hurt an employee.

[GekkePrutser]

You can remove admin rights but portable software will still run just fine. It's actually really hard to stop unapproved software from running on Windows. You'll basically have to cut off all the methods of ingress like USB sticks and internet.