Lock down everything

Turning it back on is manual at each PC — nothing can re-enable it remotely.