And even then, sooner or later those users who have the option of a total software restriction policy will have to disable that wall occasionally to perform certain administrative functions.
I haven't run into many scenarios where I need to disable SRP to do admin work. Here's the only one I can think of: let's say I want to run a .MSI file to patch Office or something. On Vista, if it were a .EXE file, I could right-click it, choose "Run as Administrator," and that lifts the Software Restriction Policy for that file (since I choose not to apply SRP to my local administrators group).
But with .MSI files, there's no "Run as Administrator" option on the right-click menu

My solution: run a command prompt as Administrator and use the CMD window to launch the .MSI file. Not exactly newbie-friendly, but hey