For those deploying Windows 7 using Windows Automated Installation Kit, you may have already noticed that Windows Preinstallation Environment (WinPE) overrides permissions we set in NTFS. This is especially manifesting itself in a PC refresh scenario where you can use Hard Link Migration in USMT to migrate files/folders and settings, but you were not prompted for any administrative credentials during WinPE bootup.
Ergo, one can just boot from WinPE and lo and behold, all the files are available at one's disposal.
With this in mind, how do we emphasize on local PC security? Bitlocker would solve this, however BL is only available in Enterprise and Ultimate. Most desktops out there would not have these Windows 7 editions.
No right or wrong answer ... just discussion.