Restrict PC Access with Active Directory

Question

Hi, by default I find myself the admin of a small W2K Server SP4 domain with several workstations, all running XP Pro. I need to limit access to several of these workstations to a specific group of users. In an effort to do so I have moved the affected workstations in to their own OU. Next I created a new Local Domain Security group and added the users that I need to restrict to this group. Then I created and linked a GPO to the new OU to Deny Logon Locally for the new Local Domain Security group. Unfortunately this has no effect. The restricted group of users can still logon to the workstations in question. I have searched the forums fervently and appear to have AD configured properly. If anyone has any insight in to this dilemma I would appreciate it! Thanks in advance!