Group Policy for W2K Term. Server Users

I have a Win2k Terminal Server running in App. mode which is also a Domain Controller running AD. I can effectively get the GPO to lockdown the standard PC desktop but whenever someone connects via a Term. session the policy does not seem to apply. I do not need a per machine policy but a user policy. What am I missing here?

NOTE: This is a test lab enviroment, the actual deployment will be on Winterms running Windows CE embedded. This is also the only server on the network, it will bea deployment of about 30 thin clients. I also understand the “log on Locally” rights, the server is going to be located in a locked server room.