System Policy on Terminal server… HELP

We are using IBM AIX systems to access our NT Terminal Servers NT 4.0 running Citrix Metaframe. What’s the procedure to set up a user policy for our non admin users so they cannot access the run, administration tools, display properties, etc. We’vemade several attempts but are not getting it correct. One partially successful try turned off the run command but it also turned it off for the users who had admin rights. Our PDC and BDC are running on NT 4.0. Thanks!