Also, for every AD/GPO key on security there are 2000 ways either overriding them or doing huge harms with Office macros, OLE calls, VBscript, OCX compat calls and so on.