NO argument here. The problem we've had is with remote offices (really remote) and rogue IT groups that resist conforming and upper mgt who is averse to upsetting their loyalty to the dept. Sad. But in our AD2k3 environment, the GPO/computer startup script option seems to work well for those. Cutting them out of local admins also helps.