What is the best way to lock a local box on a network?

["Martin Tran" <martinqt () gmail com>]

Hi guys, I was wondering the best way to lock a local box.  Things such as,
1. Can't install unauthorized programs.
2. But can install programs/softwares on a list that is acceptable.

I went to gpedit.msc and gone through the options, but everything
seems really cut and dry.  For example, If I was to enable an option
to stop users from installing unwanted software and user tries to do
windows update, it wasn't allowed to proceed with the process saying
they needed administration rights to the box.

If you guys can shine some light as I continue to do some trial and
error on this test box, any suggestions would be great and
appreciated!

-- 
Martin Tran