Our domain is very open with giving users freedom to work as needed – we don’t have many policies to restrict them. But the policies we do have we enforce where-ever we can. One of the important ones is desktop Antivirus and Configuration management, but I’ve been using this technique to deploy Salt-Minion to servers as well.