We do this routinely in our environment (1500 nodes) using group policy. Some end users are local pc administrators, and sometimes they screw around and change local security policies, but as SeaSpray0 pointed out, the domain security policy overrides the changes they made (in our environment...