I was stuck supporting IE6 for a lot of large organizations and was often in the loop on why they decided to stick with it. I never heard the ability to set strict group policies as a reason. What I mostly heard was internal web apps built for IE6 which needed to be updated to support IE8, and the incredible pain to actually get those update projects approved. There was also the one customer, a large bank, who had built a custom browser around the IE6 engine, and mandated its use for bureaucratic reasons.

I mostly solved our IE6 problem by moving over our web product to a single page architecture based on ExtJS in 2007. ExtJS had a browser abstraction layer, and as long as you built your screens out of its components you rarely had issues. The major pain points that remained were memory leaks (IE6 was a digital sieve, and SPA made it worse), and performance.