Start by making sure that the are not a power user or local administrator.
If using XP Pro you can use Software Restriction Policies to manage what
users can run and install on their computer. With W2000 you would have to
rely on restrictive NTFS permissions and the two Group Policy settings for
white list/black list applications in user configuration/administrative
templates/system being sure to read the full description of those settings
and understanding that if a user can rename an executable or copy a renamed
executable to his computer he may be able to bypass applications on the
black list. The links below may help --- Steve
