Term server user dial-in permissions.

What is the best method of securing, or
locking down, a terminal server client dial-in session, so they have rights to most programs, however, They cannot get or harm any critical
registry or system files, and above all! they will not be able to have the choices displayed to Shut Down the server or Restart the server remotley. They are running in win2000 mode with win2k client pc’s.