Good job having your public users run as non-Administrators. You're doing right to do that.
You have multiple items to respond to. I'll start w/ the application shortcuts:
It's unclear what you mean by "moving" machines "into groups". I think you might be talking about Active Directory Organizational Units. Computers can be members of security groups, but I doubt that's what you mean.
You should read-up on the "All Users" profile. In the "All Users" profile (right-click the "Start" button and choose "Explore All Users" to get an Explorer view of the "All Users" profile), there is a "Desktop" and "Start Menu" folder. Items placed into these folders will be visible to all users of the computer.
My guess is that you're installing an application that's placing a shortcut onto the "Administrator" user's personal Desktop. Assuming that the application puts all its files and registry entries into machine-specific areas, you can safely copy (don't move-- copy and delete!) these shortcuts from the "Administrator" desktop to the "All Users" desktop. You don't want to move items from the Administrator's personal desktop to the "All Users" desktop or the resulting shortcut files will retain permissions that will prevent non-Administrator users from executing the programs via the shortcuts. Copy the shortcuts and delete them from their original location.
It sounds like you're creating local users on each computer. In a domain environment you don't need to do this (and, actually, you really shouldn't be). You should be creating users in the domain using "Active Directory Users and Computers" so that the user accounts can be used from any client computer, can have their password centrally managed, etc.
I don't know what you mean by "how can I make all the group policies appear in the console?" If you can clarify and, perhaps post a screenshot, it might be easier to respond. (You may want to post that as another question to keep this one clean and on-topc with the title.)
Edit:
I'm assuming you're using Windows XP client computers. The book you mentioned isn't familiar to me, but I'd caution you that it will probably direct you toward practices that are applicable in peer-to-peer networking environments. You have an Active Directory domain environment, per your question, so some of the techniques in the book probably won't apply.
There are a few points in your comment I wanted to reply to. I'll do it in a quote / response style to cover each point in isolation.
...even though there is a public user
on the server, and I can see it from
Control Panel/Users...
It sounds like you're looking at "Local Users and Groups" on your client computers. If you've created a user in the Active Directory domain called "Public", for example, you don't need to create a "Public" user in "Local Users and Groups" on each client computer. (That's the point of having an Active Directory domain-- you create user accounts centrally in Active Directory and are freed from creating "Local Users and Groups" on each PC. Imagine a large company w/ thousands of users and computers trying to manage passwords across thousands of instances of "Local Users and Groups.")
Assuming you've joined the client computers to your Active Directory domain, you should be able to click "Options" in the "Classic" logon box such that you're prompted for a username, password, and "Log on to". That third line, "Log on to" will be a list-box from which you can select the client computer's name or the Active Directory domain's name. By choosing the domain's name and entering the "Public" domain user account's name and password you will be able to logon to the client computer w/o having to create any entries in "Local Users and Groups".
Domain user accounts will not be visible in the "Local Users and Groups" control panel on client computers. Anything you're seeing there is coming from that client computer's own user / group database (called the SAM-- Security and Accounts Manager-- database).
I explore all users as you suggest,
there is no Public user and therefore
no desktop or start folders...
I'm suggesting that you place copies of the application shortcuts that you want to be visible to all users of the computer onto the "Desktop" subfolder of "C:\Documents and Settings\All Users"-- not of the "Public" user's "Documents and Settings" subfolder. By doing this, the shortcuts will be visible to anyone who logs-on to the computer.
As an exercise in understanding the function of the "All Users" desktop folder, try the following:
While logged-on as an "Administrator" user on a client computer, right-click and "Explore All Users" on the "Start" button.
In the "Explorer" window that opens, navigate to the "Desktop" subfolder of the "All Users" subfolder of the "Documents and Settings" subfolder of the hard disk drive.
In that "Desktop" folder, right-click in the right-pane of the "Explorer" window and choose "New" and "Text Document". Name the document file anything you want.
Logoff and logon as the "Public" user. Observe that the text document you created above is visible on the desktop. Attempt to delete the file, and, provided the "Public" user really doesn't have "Administrator" rights, you'll see that the file cannot be deleted. Items placed onto the "All Users" desktop are visible to any user who logs-on to the computer, but cannot be modified (deletion is considered a type of modification in this case) by non-Administrator users.
I see that you're in Nebraska. Unfortunately, that's a little outside my greater-Dayton, Ohio metro area service focus. I got my start using computers in my local public library (about 25 years ago) and I've helped out in some public libraries in my professional life. If you were just a wee bit closer (okay-- more than a wee bit) I'd stop by and get you started. >smile<
All Users
profile Desktop folder (in Documents and Settings).