Seems to me Win 2000/XP already have builtin programs to act on Active Directory, namely MMC, mmc.exe, and Group Policy, gpedit.exe. Open Run and put one of those in.... MMC has snapins that do pretty much what you want on AD.