Over ruled by the powers that be.
I'm almost to the point of just not worrying about it. Don't filter anything (except for virus of course), you can have it all.
Mgmt certainly has no concept. They believe in making the user happy. We are currently configured that no users have local admin permissions. That is about to change, I think. The user power whine.
My suggestion to fix that is in line with what you said about e-mail. We have a standard load. User complains about machine. We see software that we did not load. "Oh, sorry, I have to take your machine to fix it." Standard load ready to be blown down, wipe drive, done. Here is your machine, works fine - for the software that we support. Bye."
Not the ideal solution, more of a drastic reaction to weak mgmt. Perhaps someone's light bulb will go off that maybe, just maybe, users should not be able to load what ever they want.
LVM