Overriding Domain Firewall Policy to enable firewall

Our Windows 2003 domain has a Group Policy in effect to disable the XP
firewall. The reasoning behind this was that because we are already behind
two network firewalls, disable the XP firewall. We used to get numerous calls
a day because users had misconfigured their XP firewalls and needed help
sorting out the connection issues.

We'd like to be able to enable the firewall for user's with notebooks when
they connect off the corporate network. What are the best practices for doing
this? We've tried to enable the firewall this way and it's always greyed out
in the Control Panel applet.
--
Sandy Wood
Orange County District Attorney