Windows 2003 User Rights

I have recently installed Windows 2003 Server Exchange 2003. When domain users log-in, they have no rights to run applications such as Outlook or Internet explorer. If I give them Domain Admin rights they are able to do anything. They only require enough rights to run Office and surf the internet.

All users have roaming profiles.
what am i doing wrong?