Protecting System files

I am trying to stop users deleting system files or installing any software on their Windows 2000 Professional desktops.

They log on to a Windows NT4 domain to access their network drives, but how do I restrict what they can do on their PC’s.

Iam new to Windows 2000 and would appriciate any advice.