IMHO, it depends on the company, their data retention and security policy, and what you mean by “locked down.”

I’ve had IT departments that are comfortable giving everyone admin accounts and full sharing access, and IT departments that control every little thing that goes in and out of your machine.