Client Control over win2000 professional

I’m looking over internet trying to find a tool that could help to make user`s desktop not install programs and change the settings on control panel using local administrative account! is this possible or I should use for network users a domain account to log on their own desktops?