Windows 2003 Active Directory and Security

Good morning to you all!

I would like to ask a question, because I’m kinda confused with a certain task, that we want to implement in our company. We have decided to put active directory to our network, with Windows 2003 Enterprise Edition R2 SP2. The desktop clients, will be hardened for security reasons, and also we want to limit access to several programs and functions of Windows. For example, disabling in Internet Explorer the help button, access to options etc. The question is the following. This procedure should be done, through the active directory or configuring a secure desktop first, clone it with sysprep and afterwards, distribute the image via WDS?

Thank you in advance,
Thanos Kontonasios