First of all you need to NOT give them admin access to their computers.... Then the default permission of the file system should pretty much be locked down for them... remember they do need to write to some folder like their profile/temp folders...
Otherwise you can control the permission on the files and folder by going to Workstations > Computer Configuration > Policies > Windows Settings > Security Settings > File System
Alan Burchill
http://www.grouppolicy.biz
