Win2K desktop in NT 4.0 domain

I’m having a problem finding information about locking down a Win2k desktop in a NT 4.0 domain. I know you can use policy editor, but that does not completely lock the desktop from changes at least from what I’ve seen so far. Thanks for the input.