restricting permissions for specific users on 2003 server network

[Lightninghawk]

Hello Everyone,

It's been awhile since I've found my way to daniweb. I've missed the place. But now I have come back for a little bit of help myself.
I'm helping out a local private school with there network. Unfortunately their budget doesn't fit the needs of a nice hardware or software firewall or other means of keeping the kids straight.

So I'm looking into a more simple less expensive way of doing things.

Network Specs:
Microsoft Server 2003
- client systems are XP Professional

Is there a way to disable various controls through Active Directory for specific users.
- System Properties
- Display properties (students find it quite entertaining to change the background and screen saver to X-rated materials)
- access to task manager

Also via Internet explorer itself there is a way to block sites simply by entering them into the restricted sites section.
Myspace.com Youtube.com ect...

Is there a way to do this across the entire network from the server?

Keep in mind I only have to do this to one account. The students all use one account to access the computer.

Thank you in advance for any suggestions.

~Lightninghawk

[Lightninghawk]

There was mention of creating a profile and setting it for the user that needed to be restricted.

Also another recommendation was that I set permissions on a usergroup. But I have not seen a way to do either.

Any help is appreciated

[DimaYasny]

what you do is create an OU (organizational unit) in active directory, put the student users/groups there. OUs can be managed from the group policy, providing all restrictions that you might ever need.
a good idea is to get GPMC from the MS site - it's a bit more usable than the standard GP control mmc