Disabling User ability to add hardware

I would like to know if Win2000/XP can be configured on a workstation to prevent a non-admin user from adding hardware on their machine, e.g. A user comes in with a zip drive and ties it into his Win2000 or XP PC. He reboots the machine and typically, the OS will see the device and add it. Is there a way with the OS to prevent this from occuring? Or am I forced to put the PC in a cast?