as we cant disable activex in office, the kids have now figured out that they can make word documents at home, drag in swf and exe files into word, or add them through the insert menu save the file as a word doc, then open it up here, double click the exe and it runs.
a massive massive security hole, I just wish ms had a gpo that you could specify which filetypes can be embedded in word.