Lock down terminal sever sessions

Hi,

I run a lan/wan for 2 CPA office. All users use term server for apps and data. A vendoe installed on network earlier this year and configured remote desktop icons for all apps on each desktop. I would like to move to the complete desktop being hosted by term server. The proble is when a user logs in the can get to everything on the term server. I implemented and MS Q278295 as a test and moved a dummy user and my reg user id to the new OU. The articles states to Create a new OU and then create a new GP and disable the items listed in the tech note. I did what the article stated but nothing was chnaged when I logged in as a user. I then moved my user to the new OU and it worked but the profile was not the same as it had been. In other words all the icons for apps that were on the desktop were gone. My structure is as follows in AD:

WOP (domain)
Accounts (OU)
Ral (OU)
GBO (OU)
term users GP (new OU)

Once I get this tested and working how I want it....How do I move my users to the new (OU)? My users for each office are in the Ral and GBO (OU). Would I move the RAL and GBO into the Term user GP (OU)? The tech note does not state how to get it to work...just states to creae a new OU.

thanks,
Rob