Use IPSEC to isolate your domain. There are a couple of documents on the MS site that talk about it. There are even a couple of webcasts. ________________________________ From: windows2000-bounce@xxxxxxxxxxxxx [mailto:windows2000-bounce@xxxxxxxxxxxxx] On Behalf Of Herchenbach, Jim Sent: Monday, October 17, 2005 10:36 AM To: windows2000@xxxxxxxxxxxxx Subject: [windows2000] GPO to do.... I'm looking for a GPO that would not allow access to a workgroup that resides on our network, but is not part of the domain. I've done some looking but haven't been able to find what I need. Running windows 2000 server...all clients are windows 2000 or XP. Tia Jim Herchenbach St. Francis Schools