OK here's the deal (me pulling my hair out)
 
I have 5 workstations (WXP) and 1 Domain Controller (W2003).
 
All machines reside in the XYZ domain.
 
I need to lock down the workstations, i.e. remove icons, start menu items ect.
 
When i choose a setting local to the workstation (i.e. gpedit.msc > disable "run" from start menu) i can still see and use "run" using any and all Domain user accounts. However when i log into the workstation with a local computer account i cannot use the "run" command.
 
I have not made ANY changes or implementations to the default domain GPO.
 
please help
 
thanks
 
Jared