I knew posting the question would prompt me to find it....
for anyone else who wants to know, it's in 'Location-specific settings' - 'Server Control', which is under the policies tab of each group.
(Which is a bloomin convoluted way of doing it IMO)
Thanks
nick