Everyone can logon locally to servers

I have just discovered that all users can logon locally to our Windows 2000 Servers. Obviously I want to change this immediately. What is the best practice for changing this to local Admins and Domain Admins only. Some of the servers are domain controllers, and some are not. Do I use local security policy for non-DCs and Domain Controller security policy for DCs?

Thanks