win2000 domain restrict

I have a win2000 domain with 200 users, win2000 workstations…
how can i restrict user(s) X from running “game.exe” from any machine?
they have a partition with full rights so i have to disable from registry somehow…
thanx