What rights do your PC clients have?

I just read the discussion thread regarding admin rights for execs…it’s obvious that many of us have the same problems. For those who are able to lock down their environments, just what permissions do you give your users? Are they power users or users? What OS? What are the biggest limitations or gripes clients complain about? I’d like to know what internal IT obstacles you’ve encountered along the way to maintain the locked down environment. Unfortunately, we still “allow” our W2K clients(ACTIVE DIR domain) to have local admin rights. We’re a pretty large site with over 6000 PCs, so this wouldn’t be an easy implementation. Any thoughts?