Examples of Group policies to lock down laptops in the field

We have a sales force of about 60 people using Thinkpad T60s. Currently we are having to rebuild these units every week because they get infected with spyware.I would like the users to have limited accounts with certain lockdowns so that they cannot install software and virulent malware cannot infect the system…any suggestions.