GPO, not simple you should ask another, more specific question. e.g policies can prevent access to add/remove programs, but it won't prevent a person installing a program via a CD/DVD!
MS allow the use of certain tools to lock down domains, however, the last time I looked the only legitimate use of these tools is if you were a not for profit/school/library. This may have changed with the latest version 'SteadyState' but I think that it works best with "Vista".
This software block attempts to install software, any drive you don't want accessible, any tranfers the active boot drive to a non accessible partioned disk space so that it can load an image each time it is booted.
The image can only be varied via window update and allowing a gateway extension to allow security program updates, however, if you're not using a supported program you will need to write/edit approprite scripts to enable this!