you need to ensure the only members of ou1 are allowed to run rdp files