Stop people from Installing

It's not so much group policy, it's ACL's. Plain and standard to use with W2K Explorer.
Make sure that users have only READ ACCESS to almost all directories on the server, and write access solely to a few data dirs where no programs can run. Similarly to registry (use Regedit to put ACL's): make sure that they can not write any keys needed for installing new programs.

Additionally, there must still be a few settings in Group Policy which support this policy - but GPO is not the main enforcement here.

Hope this helps a bit,

- The Netherlands

Active Directory can help you with group policy and user rights assignments for those who access your network. Further, depending upon which security groups you assign to those who access your network will determine what rights they have. From the control panel, click administrative tools, then open Active Directory Users and computers. from there expand builtin. In the right pane click on users. this opens up the User rights assignment policies for this group. On the members tab add/remove users you wish Also in the left pane of Active Directory you can expand users and define what groups users belong to. Security settings for the users group are again determined by the default users group security policy. Another group security account to consider in using for all people who access your network is the guest account. Further, you can configure your network to direct users to distributed files instead of allowing a my computer explore browsing.

As your question does not address a security breach where a user had access to the admin account to install a program, I can only assume that this question was already addressed. If not try renaming the admin account and use a alph-numeric password with at least 8 characters.