If you're doing it right then you're using GPO and/or the policies file to lockout the ability to tamper with your preferred DNS settings on browsers in the enterprise.