Just spent a while trying to make a RasDisable adm, i'm a bit of an AD rookie but it seems work ok.

CATEGORY "Logon Settings"
KEYNAME "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
POLICY "RasDisable"
VALUENAME "RasDisable"
VALUEON "1"
VALUEOFF "0"
END POLICY
END CATEGORY