A couple ways come to mind. You could use Group Policy/computer
configuration/Windows settings/security settings/system services to set the
Terminal Services Service to have startup type of disabled at startup or use
Group Policy/computer configuration/administrative templates/Windows
components/terminal services - allow user to connect remotely using Terminal
Services - set to disabled, or configure the user right for those computers
for "allow logon through Terminal Services" to contain no users/groups.
You can manage XP Pro Group Policy specific settings in a Windows 2000
domain by managing Group Policy from an XP Pro domain admin workstation
[including installing Group policy Management Console on it] or updating the
..adm templates on your Windows 2000 domain controller. --- Steve
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/mngwinxp.mspx
http://support.microsoft.com/default.aspx?kbid=842933 -- apply to domain
controllers BEFORE updating to XP SP2 .adm.
