Spazzo

I currently have a large W2K3-based domain. I'm in the process of retiring all NT servers and Workstations. I would like to prevent anyone from bringing up any new NT4 workstations or servers. I can't just restrict NTLMV2 because most people are already running SP6a. Is there any other way (group policy?) that I can restrict domain membership based on OS? Thanks in advance. Spazzo