Local Security

I support computers in a work group in a school setting , and I’m creating a ghost image for some new computers. I want lock down the desktop to prevent anyone from changing it, i.e. webshots. I would also like to prevent them from downloading anything. I’ve made them users, so they can’t install anything. Finally, the question. Are there any local rights/policies that I can change/set to accomplish my goal?