How do I block the ability for users to change permissions on folders/subfolders they create?

I am running a centralized W2K3 file server cluster for a large school district.  We have users to know "just enough to be dangerous" and change permissions on folders they have created.  I have granted these users Modify permissions so they can create/modify folders and files, however I only want our network admins to set permissions on ANY folders.  I have removed the Creator Owner group from the root of the drive so that's not the problem.  I have also set an explicit Deny Change Permissions on all folders, subfolders and files for this group, however when they create a new folder, they can still set the permissions on it.  I don't know how to stop this.  Please help!!!