you need to ensure that only members of ou1 can run the remote desktop protocol files