Hi, we're looking at using bitlocker in the enterprise but have run into a concern that any local administrator can disable the encryption regardless of the enterprise management requirements.I've been unable to find a policy to prevent this. Am I missing something here?

There is no way to enforceBitLocker encryption if the users are local administrators .The only way of doing this is to remove their administrative priviliges which in many (most) cases can be hard to accomplish, even though it is possible to solve many of the problems with having standard users.

Okay thanks.

Is there no way around this? The way Vista is designed, our users constantly have to select to run items "as administrator" just to get any work done. We need to ensure our data is encrypted and protected, but not at the cost of losing total worker productivity. Hasn't Microsoft found a way to resolve this? It seems like a pretty big hole in the Bitlocker plan.

a bit late maybe, but: this is not something Microsoft can or even should fix. If your users are local admins, they are local admins. An admin is an admin is an admin. They can do anything on the client, and you cannot prevent this! That's a given fact, and it does not make any sense discussing that. If you need to revoke rights from a user, make your users Standard Users or maybe Power Users It is also not true that you need to run most apps as an admin. If that is the case for your applications, you should perhaps contact the authors of those apps, as they simply do not follow common programming guidelines and policies. Most of the time the author either has an update, or at least can tell you what to do to make the app available for standard users