I need a sure-fire way to prevent manual, automated, deployment, or push SCCM Client installs from specific computers (they are medical, and will violate FDA regulations if non-approved software is installed on them). I'm aware of the Registry entry on the Site Server, but, am looking for something on the target computer side (RegHack, phoney file/folder, etc.). Discovery of the computers, but inability to install the client is OK (we'll be removing them from the Discovery LDAP queries as needed).
Our SCCM Hierarchy is in one Domain, and the clients all in other Domains, so, I could look at excluding the client install account, but, that won't stop a manual or automated install.
Thanks.