Adrian,
There are three choices that you have here:
1) create an OU structure so that all of the WIN2000 computer account
objects are in one OU and all of the WINXP Pro computer account objects are
in another OU and link the GPO that deploys WIN2000 SP4 to the OU that
contains the WIN2000 computer account objects, or
2) place all of your computer account objects in the same OU and link two
GPOs to that OU ( assuming that you will ultimately be deploying SP2 for
WINXP via GPO ). You could then use Security Groups to filter who gets
which GPO ( you know that all you need to do is to create two security
groups - one WIN2000 and one WINXP, populate them with the correct computer
account objects, remove the Authenticated Users security group form the GPOs
and replace that with the appropriate security group that you just created,
making sure to give it both READ and APPLY GROUP POLICY rights ), or
3) leave things as-is and let it fail on the WINXP systems....and SP2 for
WINXP Pro fail on the WIN2000 systems.
I would contend that the third option is for lazy people and go with first
#1 and then #2. However, we do not know anything about your environment and
do not know if you have any other GPOs that might be linked to the current
OU in which your computer account objects are located.
HTH,
Cary