Terminal service user rights control

A win2K server with application terminal installed. A normal user can now logon through terminal client with interactive user allowed. But how can I control what this user can do on this server? I wish this normal user can only access some programs.Who can tell me how to control it?