I'm toying with Open Directory using my active directory groups. It seems to all be working good, but I can't get everything done I want. For example, on the local machine I can set it so that a user can't modify their dock. There is a preference setting for dock in Workgroupd manager that lets me add dock items, but doesn't have a setting to prevent changes. How can this be done?