I asm running TS 2003

I have users in my domain that are local users within the network; however, I also have users within my network that will use both a local AD login as well as a TS session at the same time (they will log into their client comptuers for everyday computing with local apps; however they will login to a TS session to access a remote app). My question is, how do I create a GPO that will create a lock down TS session for ALL user accounts; however, have it not affect their regular logins that aren't TS sessions? The TS server will only be computing a single application, so I want lock it down tight (i.e. no access to baically anything other than the application).

You do this by creating a restrictive GPO, link it to the OU which contains the Terminal Server (but *not* the user accounts) and use loopback processing of the GPO:

Computer Configuration - Administrative Templates - System - Group Policy
"User Group Policy loopback processing mode" - "Replace"

Loopback Processing of Group Policy