locking down the new server?

[Scruby]

I have recently installed a new Citrix server on a windows 2000 domain with AD. How should I lock down the server? If I use local GPO I lock out my self when I logon to the server. If I user Domain GPO’s when the user logs on from the office the policies will apply to them and will be to restrictive for them to perform some of there work.

If I have to user both local and domain GPO’s Is there a link or can some one tell me what I should lock out with out locking my self totally out of the server?

Thanks, Scruby