Open "Active Directory Users and Computers", right-click your Domain and select "New>Organizational Unit", give it a name. Create or move some Users into that OU, then right-click the OU and select "Properties". Click on the "Group Policy" tab, click "New", give the policy a name, then change/set any policies you see fit in the "Administrative Templates" section, then OK etc...... Edit: Click "Start>Run", then type "secedit /refreshpolicy user_policy" (without the quotes!) and click OK.