locking down a 40 PC LAN XP pro machines in workgroups

I have 40 XP pro PCs, 1 win2003 enterprise server

I have my LAN grouped in 5 work groups. Suggest me a good policy to lock down the clients, so that they cant install s/w change settings etc.

Some work groups may have better privileges than others and so forth. (can this be done?)

I don’t want to use AD as it requires effort, and intrinsic knowledge, which i am not finding time to delve into right now.

I was thinking of some thing like gpedit, make a ploicy and apply to each PC, either manually or script or remotely… whatever

please suggest me something on these lines…

thanks!