Re: Nope
> booting off a live linux {CD, USB}
All BIOSes allow one to define allowable boot devices, and I haven't seen one for decades that doesn't have a degree of password protection for the BIOS setup [1]. If you care enough, you can forbid the possibility of booting from a CD.
Having said that, I used regularly to use a live CD on a secure network for which I had *my own* Windows credentials: the tools available were just so much more powerful than the ones I could get installed for Windows.
[1] The BIOS password will also be crackable, of course. Mantra: "If the geezer in the Black Hat has unfettered access to the physical device, you're screwed."