Leslie M said
Why do the users (think they need to) turn off security?
Users are lazy. Period.
Setting up security right often is not a trivial task so users tend to avoid the hassle:
"Why should I get involved in how to set up my security right when the software runs just fine with security disabled?"
So, basically, there's a simple cost-benefit tradeoff done by the users:
Scenario 1: I run the software w/o security.
Benefit: 1) Software runs, 2) no hassle with security settings, subjective goal achievement: 100%
Scenario 2: I run the software with proper security.
Benefit: 1) Software runs, goal achievement: 100%
Cost: 1) Need to learn about security settings and apply them correctly, 2) possibly issues with incorrect settings not showing up directly (like, "What was the password again?!")
Apparently, the subjective benefit for the user is the same in both scenarios. The question therefore is:
Can you reduce the subjective cost for the user in your preferred scenario (#2)? And can you reduce it to or below the cost for scenario #1?
Can you increase the subjective cost for the user in the discouraged scenario (#1)?
Subjective cost or benefit can be influenced in many ways: Big red statements in the documentation saying "YOU WILL PROBABLY BE HACKED IN NO TIME, IF YOU DON'T APPLY THE RECOMMENDED SECURITY MEASURES" may already move the perceived cost/benefit ratio into your preferred direction.
A better solution would of course be to reduce the subjective cost in scenario #2. Maybe some installation/configuration tool or the like can be provided to faciliate the adoption of the 'right' procedures for the user.
After all, I think its a somewhat childish but probably effective approach to go the annoyment way: "Ok, if you are trying to be lazy/smart and avoid the recommended procedures, I will deliberately bug you until you need to re-think your decision."
As was already stated, this is probably not the best solution as for the user experience and will probably actually have negative effects for you or your software on a certain percentage of users, but some trade-off needs to be made, it seems.