Enforce hardware keys for all engineer logins

Engineers carry laptops that hold sessions and tokens for many customer environments. A stolen or infected laptop could give an attacker the privileged access of its user.

Measures

Privileged accounts are separate from daily accounts, and disks are encrypted. The work that remains is to remove the last stored administrator passwords from engineer laptops.