I've tested both Centrify and Likewise (Powerbroker). Both add Mac-specific GPOs into the normal group policy editor that allow you to manage Macs that way. They also make enrolling the computers to AD real easy (although it isn't too difficult to begin with using Apple's built-in AD plugin). I cheaped out and extended my AD schema and am using Apple's workgroup manager to lock down my Macs. It isn't as easy to use as Centrify/Likewise (Powerbroker), but it was cheaper and I'm getting desired results.

Something like this is better handled with Open Directory which would require a Mac server and binding your Macs to it (as well as AD if want to use that for authentication). Download java for mac os x version 8. Or you can look at products like Centrify DirectControl or Likewise Enterprise which allow you to apply Mac specific GPO from AD (settings stored in SYSVOL on the DC's).