Group Policy in Local or Workgroup env.?

Hi. I consider myself behind the times due to the fact I still support Legacy Dos Apps. A new client is so freaked out about employees messing with the computer and playing that she formats the drives and installs msdos to run the main App. Now they want to add a computer to the various remote locations, I’ve asked she consider xp or win2000 and use Group Policy to lockdown the machines. All I see is Group Policy in a domain or AD setting. Can anyone point me to some resources on locking down a pc to the maximum in a workgroup or standalone environment? Much appreciated and Thank you.