Managing Computers with 10.5 Server, but NOT managing Local accounts?

Question

I'll try my best to be clear here - I'm new to 10.5 Server and a functioning Open Directory environment! (formerly used 10.3 Server and never had the OD working).
Environment:
School (K-8), with old iMac G3's (10.3.9), eMacs (10.4.11) and a smattering of Mini's and iMacs (10.5.x).
Server:
10.5 Server, OpenDirectory and DNS appear to be working perfectly.
User Accounts:
Staff members have accounts for logging into sharepoints.
No one (yet!) has server based home directories except a couple for testing.
On each computer there is a "staff" account and a "student" account.
These are LOCAL accounts, and do NOT have same-named accounts on the Server.
I have bound client computers to the Server by OpenDirector
dsconfigldap -v -f -a servername.domain.org -n configname -u diradmin -p adminpass
Now comes the trouble;
I have added the computers to the Workgroup Manager computers list.
I have applied computer preference settings for the Energy Saver preferences ONLY. THey appear to have worked (managed computers slept/shut-down/started up according to the managed preference).
NOW comes the real problem;
The "staff" account on the managed computers is denying access to most applications on the computer!
Note: this "Staff" account is local ONLY, and is NOT a server-hosted account.
I have NOT tried to manage the computer preferences for applications on these computers.
I can resolve the problem by unbinding the computer from the OD Server - but I'd prefer not to do that. I just got them all bound! And, it screws up my migration plan TOWARDS server-hosted home directories.
I have tried managing application prefs for a COMPUTER, only to have both the STaff and Student account lose ALL of their local-only application managment settings (all of a sudden, Students can open terminal, grading programs, etc).
I am obviously missing something!
At this point, I'd like to back up... to NOT having my Server interfereing with the local accounts until I'm further along mapping out my migration from local-only accounts with file sharing access to Server hosted accounts and server managed preferences.
(I will also admit I'm a bit confused about when to manage USER preferences, vs when to use managed COMPUTER preferences.).
Tips appreciated!

Answer 1

Your last question - using managed user vs. computer preferences got my attention. Mostly, I use Group managed preferences. I do use computer preferences for a laptop cart, other than that I use group preferences. Perhaps your situation calls for managing users, but using group preferences allows me to change the settings for a bunch of people all at once rather than changing settings for each user.
In any event, check all the managed preferences for your computer level settings. And since you're using a 10.5 server, you have to check the settings for clients that are running 10.4 and earlier as well as the settings for 10.5 and later clients, as they are different.
At the user level, if you have an OD account and a local account with the same name, the local account will determine what the user can do - I honestly don't know if managed computer prefs will override local settings, but you should look into it. This could be your problem.
At the very least, you should avoid "testing" with systems that folks are using if you want to avoid the frustration that you are now encountering (speaking from experience i.e. similar mistakes, not preaching).