NT4PDCW2KClientsHowImplementSystemPolicy

Can someone explain how ,if possible in a mixed NT4 domain with W2K Pro Clients, to use System Policy Editor to stop users from installing Apps locally, and from logging on locally even tho their account is locked out. Any help is appreciated, even Websites that may have mixed domain admin info.

Thanks