Block users from installing software

Under windows 2000 in a domain network where I have no access to the PDC. How can I without buying additional software, block the regular user from installing software but allow regular use of the computer? (generating data files, local database app allowed to generate files, etc…)
changing the user profile is not an option – I have over 12000 user profiles in the domain user database, I have control over 100 machines and users so whatever solution has to be machine specific and could care less about who the user is.