user lockdown

I need to prohibit users from installing programs on thir workstations, either from cd or the internet. I thought their was a group policy for this but I can not find it.
Thanks in advance,