permissions on WinNT system folders

I am just learning about local object permissions (not network shares) and thinking it would be nice to prevent users from messing up the system files in the WINNT folder. Can you tell me the best way to do this (I need a discription of the different system folders/ files that need to be accessed by the user and with what type of access) Also, can you recommend a definative publication that covers ALL the whys, weres, and hows of configuring the user environment