While working on an SBS 2008 migration I was faced with having to grant 60 users access to only Terminal Servers in the corporate network when using Remote Web Workplace
Powershell and Quest Active Roles to the rescue again.
The following script sets the msSBSComputerUserAccessOverride attribute to the desired computer
[PS] C:\> Get-QADUser | Where {$_.ParentContainerDN -eq “OU=MyOU,DC=Domain,DC=Local”} | Set-QADUser –ObjectAttributes @{msSBSComputerUserAccessOverride = ”S:1:3:CN=MyTerminalServer, OU=SBSServers, OU=Computers, OU=MyBusiness, DC=Domain, DC=Local”}