Disabling install of software to users?

Is there any other way to prevent users from downloading/installing software on a WIN 2K pro workstation in an NT 4.0 Domain besides using the NTFS permissions and totally locking down the hardrive? I could not find anything in the group or local policy settings and we aren’t using active directory.