It's still disappointing how few folks know about gpedit and how much you can reclaim your own machine just by running through the local policies and setting them to "no, I call the shots".