Prevent Software Installation

I am running a WIN2k network, servers and workstations. Is there a way through group policy to prevent users from being able to install apps. I know you can prevent some by adding them to the users local group instead of admin but i would like to beable to do this on a domain level instead of individual pc’s.