Prevent Software Installation

You can assign software distribution policies to either users or computers with Control distribution through the MMC. Here is an article written by Brian Posey describing the process. (I like this guy. He writes good articles and seems to know his stuff.)

http://asia.cnet.com/itmanager/tech/0,39006407,39078824,00.htm

REMOVE SPACES from the pasted URL.

This is done at the server level. If you assign the group policies at the server instead of locally, these policies would apply. Therefore, the users would have to log into a network domain, and not log into the local computer.

You don't give anyone, other than your system (domain) administrators, workgroup administrators, or Power Users, (as necessary), accounts on the local machines.

All personnel log ONLY, into your domain.

On your domain controllers, when user accounts are created, you specify the Groups these users are assigned to. In your case, the "Domain" USER Group. As domain "Users", individuals do not have privileges to install apps on the local machine.

Depending upon the size of your organization, the Domain/System Administrators are the only ones with local accounts and the privileges on them to perform allowed tasks. Create additional Groups, as necessary, on your domain controllers to set Group policies to provide a different level of authority from the default Groups.