I work for a school and we have a computer lab that is open to the public. It seems like every couple of weeks I'm re-imaging the machines because of instant messengers and toolbars have been installed. I'm wondering if there is a way using Zenworks and group policies that I can disable the installation of any new software, but still allow the automatic updates, virus and spyware updates to be run.

Here is what I have going on. 10 computers all linked to the same public access user which has power user rights on Windows XP systems. I'm using Windows Group Policies to pretty much block access to anything from the start menu and control panel, along with access to Internet Options from IE and use Application Launcher to place the shortcuts on the desktop. I also disabled the windows installer, but somehow that hasn't prevented Yahoo messenger and toolbar from getting installed on some computers, which also overrides our default home page. Also, I think an unintentionalresult of my "lock down" policy, I cannot obtain remote access to these machines either. We used to have an executable specific block policy, but some users have found out that changing the name of the file will get around it.

Has anyone out there successfully blocked these things from getting installed? Am I on the right path or should I try something else? Thanks.