RHEL4 and Active Directory user management

["Shawn Kovalchick" <bamapookie gmail com>]

I have successfully set up authentication with Active Directory using winbind and have set up PAM to create new user directories when users log in for the first time.  Now I two user management tasks I need to figure out:

1. How can I restrict who can log in?  Can this be determined by AD group membership?
2. How can I add domain users to local groups?  If I can't, is there a way to use domain groups for file level permissions?