microsoft.public.windowsxp.security_admin

Oh, and an addtional point, have you checked what groups the users are
members-of on the domain-controller's console? If they are members of Domain
Admins, for example, then you have a security-hole you could drive a truck
through. This may not be apparent if you're looking at the local goups.