We created a set of RAS filters that we can call up in the user's RADIUS record - Block ICMP request, Block SMTP outgoing, etc. When the user has a virus we just set the filter. They can still get on without doing any damage, yet still download fixes, etc. They might call if they need to use SMTP instead of webmail.

----- Original Message -----

...

...

Short of turning off their network access, why won't users fix their computers when the computer is infected or needs a patch?