Block users from installing applications themselves

[andyds]

Windows Server 2003 - Client XP

I have a Domain Controller set up with some GPO running to lock down the users. They do not have access to the C:\ drive at present.

Is there any GPO setting to prevent users from installing applications themselves? For example, via a USB pen. Maybe there is another way to prevent this?

 

[kmkeshav]

Don't add them to any privileged groups like Local Administrators, Power Users...

 

[andyds]

They are not part of any of these groups. Is there not another way to prevent it?

 

[Davetoo]

If they're not part of a group that is permitted to install software, then how exactly are they doing it?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.