W2K public access pc lockdown ?

What is THE method to lock down a public access pc so it can only browse the Internet and not run any other programs, Yahoo messenger, change background, etc. I can do most of it in local security policy, but can’t lock program access. I created a package with “Internet Explorer Administration Kit” which works but if I only allow Iexplore.exe as the only program to run, all Java applets fail.
Thanks in advance.