Security

If you're in a domain enviroment, create a mandatory profile for the user. but be sure to setup folder redirection for their data etc.

or

you could modify the local registry and redirect the desktop folder to another location that is set to read permissions.

Free download "Fresh UI" from (freshdevices.com).

After installation and free registration go to the Windows Interface/Desktop/Active Desktop Restrictions/allow user to add items/=no.

It's advisable to set a password in FreshUI so that only sysadmin can make changes.