Controlling the desktop

This topic has been brought up previously, but the question and answers are several years old. I would like some current comment.

What software is used to lockdown or control the desktop where you work?

Do you depend on a policy statement and reinforcement from management or do you have to resort to other ways to keep control?

What do you allow and what do you block?

Do you have different levels of access or is everyone treated the same?

How did you do it (i.e. deal with the politics)?

Needless to say I want to lock down the desktop, but I fear I will encounter more trouble than it is worth, including a mini-mutiny from my own people because they think we’re not being tough enough.

Thanks!