...
At some future date when AppLocker is considered safe for our clients, the opt-in logic would become opt-out. Any PC in "Campus Clients" would be subject to the policy unless they created a "no-applock.txt" file (or some such signal TBD).
(Yes, AppLocker makes even more sense for servers, which run a more predictable set of software.)
References For Understanding AppLocker
...