W2K Pro Security

Need Quick & Dirty steps.
W2K Pro workstation logging into NT 4.0 Server. 25+ individual users and indivdual systems. I would like them to have access to selected apps & functions and restrictions to what they can actually change on their desktop.I want each user to be able to move to different workstations and logon.