Also if possible I would personally setup a virtual DC on your PC using NAT and a client ot test everything before pushing it out to the network. some of the GPOs can get unruly even with good test enviro. It is always best to test them out and watch the rsop.msc / gpresult to see if anything is conflicting or just not working for whatever reason. This is starting to sound like a diatribe but I want to make sure I steer you in the right direction and not to make some of the same mistakes a lot of us have with GPOs. Get Group Policy Manager Console (GPMC) for your domain control if your on 2003 if your on 2008 I believe it already comes installed by default. Also do not ever change the default domain GPO or the domain GPO. This is just a rule of thumb as they are basically templates for the DC. I personally make separate GPOs for different things such as servers, client PCs, Users, and other various things, keeping in mind that to many GPOs can clog up the users log on time. This is true for either large GPOs or to many while logging in. You can always alleviate this by writing scripts that run from a GPO after login, but all in all you don't want to affect the user experience to much or you will start getting calls like crazy. Good luck with the GPO implementing.