In AD users and computers select the security group you want to work with, usually a site unit. Open properties > group policy > edit > user configuration > administrative templates > desktop.
This will direct you to the core of what you’re looking for. Familiarize yourself with all the parameters in the tree. There are some that conflict with each other and little readily available documentation that speaks to you. Read each parameter carefully to understand just what it intends to do. Careful testing is highly thought of (i.e. helps prevent angry phone calls).