Altiris 7.6 Security Role Settings - Selectively deny deployment

Hi,

I would like to disable the abiltiy of all roles (excluding the predefined 'Symantec Administrator' and a created group "Server Delivery") to be able to send commands to the Symantec Management Agent residing on servers.

We have had an incidence of unwanted software being delivered to Windows Servers and scripted tasks (which included a reboot) being pushed to Servers.

I effectively would like one group for all devices (Desktops / laptops etc) and one role for (Servers).

Any advice on how to set this up in Security Role Manager?

Thanks,

Alex