Ok, here goes..... I have a stand-alone server (yes, I know) that I want to apply a group policy to certain groups of people who log-in. But, since this is a stand-alone server, if I apply a group policy, it is applied to all people logging in to that server. For Stand alone servers, the Group Policy help says to use the System policy editor....How do I apply the created system policy to specific groups logging into the server?

Are you familiar with NT Policy editor? If so you know that you were able to base policys on user groups. Its the same in 2000, you create a policy based on a local group that you have already created on that server. Beware that if you create a policy and it doesn't quite do what you want it to or you need to reverse its affects, you will have to create a whole new policy to explicity override the settings of the first. I hope this points you in the right direction.

Not sure what the firt response means (think I need more caffeine). But, if you have a stand alone server that isn't a PDC or anything that is sitting by itself, then what you have is a workstation that just happens to be running the Server OS. SO... any policies you create will affect everyone logging into the system. Kinda sucks, but that's the way it is. Easiest workaround is to create a shortcut on your administrator's desktop to the group policy (so they can always access it). Then go in and do whatever you want to secure stuff. When you need to change something you'll have to open the group policy and edit it, do what you need to, then re-edit the thing (most changes take place without you saving the policy, and some requre you to log off and back on). Basically, it's SO much easier if you have a server on a network to run the policies from.....

So there is no way to use System Policies that apply only to specific groups on a stand-alone machine? The help says you can by using poledit.exe, but then doesn't say how you apply that created policy....

I'm also confused. If you have a stand alone server, no domain controller, then what do you mean by saying that users log on. Users don't log in to your stand alone server. They either log into a domain or into their local pc. The fact that you have a stand alone pc is irrelevant to the other users. If you want to apply a Group Policy to several users you either apply it at the domain or OU level in Active Directory - which you don't have - or apply it as a local security policy. Assuming you have all W2k pc's you can create a policy on one machine, export it to a template and then import it into the other machines. You use poledit.exe on 9x and NT clients. ...unless I'm missing something here.

The users log into the server via Terminal Services.....I haven't added the server to the domain and want the option of leaving it as a stand-alone server....It looks like I may HAVE TO add this server to the domain to get the proper security/group policies in place, but wanted to apply the policies without the server being in the domain.... Long winded....but hopefully that makes more sense....

It's a whole different world when logging into a Terminal Server. The terminal server does not really authenticate the users in the same way. If you want to apply policies to a group of users, Group Policy, then you must have them join the domain.