how do I lock down users

I am setting up a network with 1 W2K Server and W2K Pro clients. I know how to lock them out of control panel and prevent them from installing drivers, but how do I lock NetNbhd(so they can’t plug in our DNS server and surf).

What else can/should I lock them out of?