I think you really need to use a GPO to do this correctly on Vista/Win7