We now find ourselves in this exact situation with the firewall.
Everyone's an admin so how to keep the firewall from being turned off. I
tried pushing out a custom configuration profile against the
com.apple.afl plist. First I had to copy the plist ...
