Agreed, Kas sure messed up on this one. I just turned the active protection policy to inactive for the computer group in the Kas Security Center. The security settings at the workstations stay in force but the stations can start browsing again. Didn't have to change port monitoring or anything locally at the workstations. Some workstations had to reboot. The good news is that hopefully this is a problem that can be fixed at the KSC and I don't have to visit all the workstations. I sat on the phone for an hour and a half before finally caving.
The emoticon that I would select right now doesn't appear to be a choice.