Sounds like you should use the same advice then - report them to their instance admins, block them, and move on.

I had a similar situation recently and reported the user to their instance admins, blocked them, and moved on.

Are you under the impression that you have to enter a Bitlocker key during each boot?

Howso? It still requires authentication, same as if the laptop booted normally.

Role-based access is absolutely the goal but I think I’m a ways away from identifying and implementing it. Responsibilities are too unclear and diverse right now.

I may need to just meet with each department manager and ask him or her what their team needs to be able to do.

I haven’t found anything like a full report on admin right usage for all users. I’d hate to go user-by-user in audit reporting - At that point I may as well just interview them.