Users in the built-in groups not getting permissions on workstations in a W2K3 Domain

I've been pulling my hair out over trying to get certain users onto DHCP classes to either filter their internet or allow unfiltered internet access. Basically I've got a transparent squid proxy running on 192.168.1.235 and gateway of 192.168.1.1. I've established some DHCP classes: "rstrc" and "unrstrc" and some vbs scripts which run ipconfig /setclassid "Local Area Connection" rstrc or unrstrc.

I first tried GPs to run the scripts but these would not work for normal users as they don't have permissions to change network connection settings. To get around this, I thought I'd run the rstrc script as a startup script for domain PCs (a GP sitting in the forest which has a security filter for domain computers) - again this didn't work.

Finally, I tried setting the default gateway to 192.168.1.235 and adding users in the Team Leader; the group then is a member of Network Configuration Operators. This didn't work either. So I tried changing it to Administrators and my test user in the Team Leader group can't even change the time! Tried restarting the local workstation, logging off, etc etc etc. Just can't get it to work and am going to start a bonfire soon.

Am I missing something here? Any help would be appreciated!