Question : logon hours via group policy

I need to restrict log on hours to all but 2 employees, the best way to do it would to create GPO link it to OU and voila!
Three questions:
1. Where do I set up log on hours in GP (W2k8 srv R2 std)
2. How do I force log off or lock workstations when logon hours expire
3. Can I apply it to entire domain and change logon hours to 24/7 for 2 employees only - will user setting overwrite GP?

Thank you

Answer : logon hours via group policy

Unfortunately, you can't set logon hours through group policy. You'll have to set them specifically for the individual users. Luckily, as Tribus mentioned, you can select multiple users and set those hours for each user. The second part is enforcing those logon hours, which *is* done through group policy. Specifically, in Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options
You'll want to set "Network Security: Force Logoff when logon hours expire" to Enabled to kick your users out when they get past the point that they're supposed to be there.