block administrators!

I think you can't do this without reducing their privs to something other than admin.

Yeah, on a Windows machine any user with full permissions and privileges in the Administrator group is a god, and all gods are equal. IMO, the way Windows handles the Administrator account is one of Windows' biggest flaws - anyone operating as a user with full Administrator privileges and permissions pretty much has, or at least can take, control over anything on the system, and so does pretty much any application running under the credentials of a member of the Administrator's group. The fact is that while most users have no need at all for Administrator-level access, most users log on as a member of the Administrator group. That pretty much explains virus, worm, trojan, and hijack infestations; its just plain too easy for someone who knows the vulnerabilities and how to exploit them to take over an imprudently configured and operated Windows machine without direct user action other than opening an email, clicking a link, or just visiting a web page