Hi everyone, As way of introduction I am the Indigenous Community ( aka: remote ) Catholic School Technical Support Officer in the Northern Terrtory of Australia ( and if you think that is a mouthful you should try answering the phone with it :-) ) To put the following in perspective I need to give a quick run down on how the WAN/LAN/domain works ( or doesn't ) The WAN we are in is the govt WAN. (ie: big ) The servers are DEET/NTSchools serviced by an outsourced group called CSG. The LAN and all client machines are my responsibility. I have absolutely no control of the NTSchools server OR Active Directory!!! ( in fact I cannot even log on to it ) Which brings me to my problem. Currently school are being given money to buy computers. We are attempting to put together a proposal for an application server/client setup rather than just putting more desktops on tables. This will give us our own application server and open up a number of development possibilities as well as lessen the demand for desktop maintenance. However, the people who control/maintain the prinmary server ( NTSchools/CSG ) do not have any group policy being handed down to the client machines which means all users have administration rights. Neither are they interested in applying a co-operative group policy...basically they are saying "we're alrite, and stuff you". So... we are faced with an inability to lock 'our' server down as, unless someone tells me otherwise, we cannot have 2 active directories on the same domain ( makes sense I guess:-> ) Does anyone know a way we can run an application server, without using active directory and lock all users except the administrator so they cannot do any damage to the server?... We have thought of sub-domains etc but would like to avoid going down that path unless necessary. I look forward to any feedback/suggestions. regards in advance Rowan Mitchell