In the Group Policy, Under User Configuration,
Administrative Templates, Under Desktop, in Active
Desktop folder, there are settings in there that can
prohibit desktop modification.
I don't think there is much you can do for the desktop, by default users
have full access to thier desktop. You can redirect desktop to a network
share where they do not have write access. You could also choose to hide all
icons on the desktop and lock down the start menu icons.
Buz Brodin
MCSE NT4 / Win2K
Microsoft Enterprise Domain Support