I have made a few minor tweaks before, for earlier versions of Windows.
Things like IE proxy settings, preventing access to Control Panel, that sort of thing. I always did this from the server using Group Policy Editor. Do MS recommend only doing this from clients?