Block Network access to PCs that are not members of domain

I work in a Windows 2000 environment with Win2k pro and xp clients OS. I have fully implemented Group Policies. However some of the users of laptops have decided not to have their laptops added to the domain. SO WHAT THEY DO IS FIND ANY PATCHED CAT5 PORT, PLUG THEIR LAPTOPS IN, OBTAIN AN IP ADDRESS AND OFF THEY GO. IS THERE A WAY I COULD DENY THEIR LAPTOPS IP ADDRESS OR BETTER STILL STOP THEM FROM ACCESSING NETWORK RESOURCES UNLESS THEY ARE PROPERLY LOGGED ON TO THE NETWORK.

what type of server are you using?

sounds like what you need is a simple MAC address allow list, then you only give IP addresses to those that are on the list

(you need a router or firewall to set this up)

as to how exactly you do all that?... well the only servers I've ever administered are linux, so I could tell you how in linux using ipchains, but someone else will have to tell you for windows