Is he wanting to keep users from writing to the local hardrive entirely, or just keep them from changing the settings?
Either way, I think setting a local GPO will be the answer. However, if he does this he should set up a new MMC (with local Computer Policy settings) rather than the default Local SEcurity Policy tool found in Administrative Tools.
If he wants to prevent users from writing to the local disk, he can do it on a limited basis by implementing disk quotas through the GPO. This can be found under Computer Configuration | Administrative Templates | System | Disk Quotas.
When setting the size of a disk quota, rmember that a user's profile is included in the size. If the quota is set to 0, the user can't even log on. Even ifhes has users set to use roaming profiles, these profiles are copied to the local machine at log on. Also remember that by default, email .pst files are also part of a users profile. Given all this, if he decides to invoke quotas, he will need to do some experimentation with quota sizes. The bottom line is that the user must have write permission to at the very least his profile folder. A knowledgeble user could exploit this to save information to the local disk.
If he wants to prevent users from changing (or even seeing settings), there are probably thousands of policy settings available through GPO that can be applied to either the computer or the user. The downside to this is that because he is using a workgroup vs. a domain, hemust apply the GPO at each machine.
