Restrict Network Accessto single servers

[iccMe]

Hi

Does anyone know if it is possible to restrict access to single servers? 2 examples I have,

1) We want to restrict RDP access to 2 particular servers on a subnet. I have tried to create a managed object that specifics 2 single IP address with RDP services allowed, however users are still unable to RDP to the servers. I see you are unable to use /32 on the end of the IP address, and I do not want to allow open RDP access to the whole subnet?

2) Restrict ldap & group policy to DC's only - again same issue as above the DC's as the same as the named Corporate DNS servers, I have ldap working by allowing that service across the whole subnet, but group policy is still not working.