I need to setup a number of notebooks that I can maintain resticted access to. We want to only have the notebooks be able to log onto one domain while still being able to get AV pattern files, WSUS updates, etc. from our "main" domain. So, how do I restrict a group of users, logon access only to one domain? Or how to only have one domain listed to logon to a group of computers?I also need to maintain a directory with spreadsheets to be read only. How do I not allow them to attached to email, copied, etc.?I would use a Trendmicro Officescan policy to lockdown access to optical drives and USB.We would be working with Server 2003 Ent. and XP Pro w/SP3 and of course anyone in the Enterprise Admin group would still need complete access.1 person got this answerI do too

You should post these questions in the appropriate TechNet forum instead of here in MS Answers. This forum is more for consumer/end users.TechNet forums -http://social.technet.microsoft.com/Forums/en/categories/MS-MVP - Elephant Boy Computers - Don't Panic!

Functionally, you can't do what you are asking. If a useraccount can access files then they can be copied.Also, unless you use anonymous access for the updates, a user must be able to logon to a domain in order to download files from shares. Anonymous access isn't too clever from a security POV anyway.

Thank you Malkeleah, I have re-posted this over on the Technet side in Group Policy under Windows Server.