Locked Computer

hi everybody,

i got a problem will my network
i got a win2003 domain server and some xp pro machine
i want to locked up the xp pro machine so that user cant change the settings
where should i set the policies?
anyone have a small network like this?

my win2003 domain is already setup and working fine
i want the xp pro machine to be setup to connect to the domain but i want to limit it
for example in the xp pro machine i want to remove other program
only the program that they used daily will be on the start menu
for example if a user log in they will use the same desktop wallpaper
in the start menu they can only see microsoft office
no icon on desktop, hide all drive
they can on see my documents so that they can save and retrive file
they can view network computers but not network setting
all administrative tools will not be seen
for example is the control panel

but if i log in as administrator, i can use the computer normally
i want to do this to prevent user from installing and changing the settings

hope some one can help and guide me

thank you very much