Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Been doing computers 20 years. Have built hundreds. Write programs in Basic,
C++, VB. Know my way around the registry pretyy good too.

I am now working with a Windows 2000 Server network. Took over from an
outside company. As it is right now its a simple network. One Domain
Controller and 175 computers.
We are 2 TV stations and 5 Radio Stations all in the same building,

The only security is groups that determine which folders people can access.
I want to take the network a little more advanced. (and secure)

What I want to do is create some sort if grouping by departments.

MAIN DOMAIN with say the following departments (groups?) below
TV Sales, Radio Sales, News Department, Accounting, Managemant, Engineering
Then I want to assign the users to certain groups. (and computers)

For example, A newsperson can log onto any computer in the newsroom and will
have the same Desktop (Icons, wallpaper, etc.) If a newsperson tries to log
into a computer in the sales office they will be rejected from logging in at
all. Same with Sales people, they can only log into sales computers (or
possibly be restricted where they can only log into only the computer that
is on their desk.)

As it is now, anyone can log onto any computer, but can only have access to
the network folders they are authorized for. There is no reason for a
newsperson (for example) to ever log into a sales or accounting computer...

Can someone point me in the right direction on this please.

Thanks

Ron