Hmmm - thanks folks for your replies - I'm beginning to think it might be easier taking them off the clients!

Thanks Klaas. I had considered this but I already have existing NT accounts for those requiring to access the GUI and windows authentication. I don't really want to change...