How draconian do you want to get? I work for a largish Higher Ed and our computer lab machines (somewhere between 1200-1700 of 'em) all have to be locked down to a high degree. It's pretty well locked down. Malware outbreaks are usually handled by just reimaging instead of cleaning them up, and such outbreaks are pretty rare.
This sort of thing is made a LOT easier in an AD Domain, as the GPO framework greatly enhances the ability to manage these stations. Even the basic "Normal User" mode for Win 7 is restrictive enough for most of our needs.
Group Policy can be used to do the following with no admin-access required:
- Set when the workstation will download and apply Windows Updates, no admin-login needed.
- A whole constellation of UI tweaks to remove things like command-line access, registry-editing access, and other such things.
- Prevent USB mass-storage devices from being accessed.
- Prevent network drives from being mapped.
- And much, much more.
Also, Microsoft SteadyState used to be a good product, but MS killed it a couple of weeks ago. We'll probably move to Deep Freeze or something else if we need to.
Locking down workstations used daily by the same Generic Office User is trickier, though. They tend to like more customization than a one-time lab-user, and get cranky when their bookmarks disappear after a reimaging.