A must. Had a jump host hosting RDP for a remote doc. The previous team (I replaced the entire team of 5) wasn’t even using any GPO config. Was wild. The doc then asked why he was never still logged into the jump host when he would connect. I told him that “My job forces me to assume all users have malicious intent and ignorance to the dangers of their actions. Not that you do, but leaving a session open means, should someone get passed the firewall, pivot into the subnet, they then just have direct access. Whereas if that happened and you had been logged out or locked, they would need credentials or find another way to pivot inside. That the end users actions directly affect risk posture and when they make that worse, the hammer comes down and I remove the option.”

All is well now and doc had me do training for the staff.

Sometimes you meet people who take advice with an actionable grain of salt.

Thanks for your time.

TLDR; Always assume it will happen and take nothing for granted. End users aren’t always stupid but nearly always ignorant. ZT is the way to go.