Setting up user security

I simply want to allow users to logon to the Win2k server from their Win2k Pro workstations with administrative access to their local machine, but not to the server. For the life of me I cant figure out how, I’m sure it is something really simple too.