[Samba] Locking Down Windows 2000 Professional

[Jamrock]

Good day,

We have set up a Samba 2.x domain.  So far so good.

We want to lock down the workstations.  For example, we don't want users to
have access to the run command from the start menu and we don't want them to
access control panel.

>From what I have read NT 4.0 system policies seem to be the way to go.  Is
this correct?  If so, what utility can I use to create the policies?  Are
there any differences between the NT 4.0 policies and those on a Samba
machine?

Do you have any links to useful documents?

Thanks.