Locking down NT User Groups/file permissions/preventing users installing ANY software

Is it possible to change/create different user groups in Windows NT/2K/XP ?

I would like to prevent users from installing ANY software. Currently (default) user group can install software that does'nt change system settings.

Also, could anyone thing of reasons why I could'nt lock down the execute folder permissions of users to only the folders they need execute from ?

 

here you can find info about group policies

http://www.petri.co.il/working_with_group_policy.htm

Win2000 : http://www.comptechdoc.org/os/windows/win2k/win2kgpolicies.html

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/lsm_overview_01.mspx

 

Thanks, I found lots of info on the default groups in windows, but nothing on changing them, just what I needed.