Denying Network Access

Hi Everyone,
I have one another query now, please help me if someone can help me.

I have Windows 2000 Server whcih is DC and clients has Windows XP. Users
are authenticated to DC. Also I have given Administrator Privileges to the
users since they are working on registry level so I have given them full
control to the Registry. Now I wanted them to stop getting access to Network
so that they wont change any settings even if they have administrator
privileges to their respective ids. I think I need to define a GPO concept
or what else can anyone guide me on this so that noone can access their
network neighborhood unless I login as a Administrator.

Thanks for your quick response...