It is no problem to lock a PC so that only the company stuff is on it and stays on it without change. This should be the task and not a stupid "ban everything".
But it is clear that it is not a single case what happened in NW, just the most spectacular one.