in mmc group policy snap in suppose to be able to disable desktop icons and start menu for clients but only allows local.. what am I doing wrong?