Windows2000 Professional Security

I am trying to configure a stand alone W2000 system so that the user has no accesss to the Control Panel.

I have set up the user with restricted access but they can still “do damage” e.g. remove the floppy drive.

Is there a part of the configuration that I have could have missed?

Thanks