Lockdown PCs

I would like to “lockdown” the PCs our patrons use in a Library environment. It was easy with NT, but 2K seems to be more difficult. I’m not sure how the “inherit permissions” work. If I start at the root directory, it seems as though I must then check on each and every folder under the root to see whether or not they inherit permissions. I need to be assured that patrons cannot save anything to the hard drive, yet at the same time they must be able to utilize MS Office and IE. From what I can tell, the Documents and Settings folder seems most vulnerable for saving files.