Stop people from Installing

I am running Citrix (Terminal services) in a W2000 domain so users can get onto my server. I have group policies to hide run, control panel, etc.. but just found someone installed Winzip. Who knows how to stop users (using W2000 group policies) from installing any programs?