Group Policy for port exceptions

Hi,
 
Several machines (XP SP2) on my network appear to be using non-domain
Group Policy settings. These machines have editable exception lists
which allow them to be individually configured to allow port 5900. I've
been able to control these machines remotely as well as if Windows
Firewall is turned off. The remaining machines appear to be using domain
settings (as indicated by the message at the bottom of the General tab
in Windows Firewall). The Windows Firewall exception list is uneditable
on these machines so I've been unable to individually allow port 5900.
Of course, I would prefer to use a Group Policy to configure all
machines on the network to allow port 5900, but I've been unable to get
the policy to work. I tried the following with various changes to
syntax: ...Network Connections > Windows Firewall >  Domain Profile (and
Standard Profile) > 5900:TCP:localsubnet:enabled:VNC
 
Thanks for any help you can offer!
 
Steve