Windows Xp

How do you lock down a machine so that a user can not run programs on a Windows XP Pro machine. There is no server and it is a peer to peer network. I just do not want a regular user to be allowed to install programs on it. Does anyone have step by step instructions.