Those of you running DSFW in your environment, what do you do about
users not being able to install software, etc?

I'm wondering what I need to do in order to allow upgrades, installs,
etc of the supported software we use, but still keep users from
installing stuff that causes problems.

I'm not very familiar w/ group policies in AD, so any suggestions,
sites to check, etc, etc would be *greatly* appreciated.