We don't give users root access even on workstations that they own. We also hack boot so they can't boot single user (at least not easily). Secure NFS may allow this restriction to be relaxed, but until we get 4.0 up throughout our network we won't be able to evaluate that.