As Shenan said make every effort to not allow the users to be power users or
administrators on their computer. Beyond that you can manage NTFS
folder/file permissions and or use Software Restriction Policies to prevent
users from installing software or running unauthorized applications on their
computers. Again this is only effective if the users are not local
administrators as local administrators have the ability to override
restrictions if they know how and want to. Software Restriction Policies are
very powerful with the use of mostly has and path rules but they take a bit
of tweaking to get the way you want and it is best to configure a test
computer before trying to apply to everybody. In an Active Directory domain
SRP and other Group Policy is easily applied to domain computers. For non
domain situation SRP can still be applied but each computer will need to be
configured individually on each computer. The link below explains SRP in
detail and beware that desktop and program shortcuts are restricted by SRP
so you would need to make allowances for such in the rules or designated
file types. --- Steve
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx
--- Software Restriction Policies