In light of the other thread, it had me asking this very question. What you did and why you did it. To get the ball rolling, Ill go first:
I noticed that a desktop machine was getting an IP conflict. It turned out that someone had brought a machine in and connected it to the network without telling us, and has set the machine up statically and pinched this other machines IP!
So I cracked the Admin password, changed it to one of our standard "12 character, combination of letters, numbers and symbols" passwords, removed the user's own account from the Administrator groups and disabled the network card in Device Manager. Then, waited
The reasoning for this is we cannot allow any Tom, Dick and Harry putting unpatched and unknown machines on the network. Especially when they do it WITHOUT consulting us and STEALING the IP address of a legitimate machine! I think he learned his lesson
I noticed that a desktop machine was getting an IP conflict. It turned out that someone had brought a machine in and connected it to the network without telling us, and has set the machine up statically and pinched this other machines IP!
So I cracked the Admin password, changed it to one of our standard "12 character, combination of letters, numbers and symbols" passwords, removed the user's own account from the Administrator groups and disabled the network card in Device Manager. Then, waited

The reasoning for this is we cannot allow any Tom, Dick and Harry putting unpatched and unknown machines on the network. Especially when they do it WITHOUT consulting us and STEALING the IP address of a legitimate machine! I think he learned his lesson
