All of that stuff is a piece of cake in GPOs. Just make a group policy on your domain user's organizational unit and mess with it
DO NOT EDIT THE DEFAULT DOMAIN POLICY!!!!
Always move your users and computers into their own OU and make a group policy there. All the options in the group policies are very well described so you will know exactly what it does.
Disabling users ability to install anything only takes a couple clicks
<A HREF="http://www.folken.net/myrig.htm" target="_new">My precious...</A>