Active Directory software restrictions

Hi,

I run a network for a CPA firm and am trying to figure out how to limit software installations and use. Due to some local software we use I have to give everyone local admin rights on their PCs. This seems to be the problem. when I created a test software resriction GP trying to stop IM use of Yahoo it allows any user with local admin rights even when I set the policy at the domain level. I tried loggin on as a user without local admin rights and the policy worked correctly. I am trying to use the GP policy that states “don’e allow the following windows programs to run at the domain level GP. I have two OUs…do I need to do it at that level? It seems local admin rights over runs the domain GP?

thanks,
Rob