Win 2k Server, Win 2k Workstation, Win nt 4.0 Workstations

[rmate]

I'm an admin in a school environment with a Win 2k server, 100 win 2k workstations and 50 NT 40 workstations. Active directory is set up with 3 main containers: admin, teachers, students. There are 2 labs (25 ea) of NT 4.0 and 1 lab (30 win2k) that the students use. My challenge is to disable IE 5.0 for the students, but allow the teachers who have active directory management consoles, to activate IE 5.0 on a per student basis, without visiting each desktop. The NT students use mandatory roaming profiles and the Win 2k students are managed by Active directory.
Any help / sugeestions is greatly appreciated

 

[brontosaurus]

For NT4 users you'll have to set up a .pol file.
For W2K users, you'll need to set up a couple more OU's, one for students with access, one not. Then, on the Group Policy for these OU's, deny the ability to run IEXPLORE.EXE. Of course, savvy students will figure out that they can change the name of the executable and run it anyway, so you may also want to set the policy to disable command prompt, disable some desktop icons, etc....