Office users access a win2003 server from within the office using thin clients and terminal services. In reviewing the security settings it seems, by default, all users in the 'Remote Desktop Users' group can access the server from outside the office, e.g from home.
We want make it by default that most users can only access the server from within the office, with another user group for the few who actually need external access.