XP user account permissions

[SonicVanguard]

So a good friend of mine is the tech guy for this small church. They have one computer that runs their media on Sunday mornings and also acts as the church's shared network drive. I know - not optimal. Anyway, someone has been messing around with that computer installing unwanted programs and so on - don't know who and the 'who' in not the point.

They want to setup the existing account as the Admin, password protected account (this is a WinXP Pro machine) and have the user account be the one everyone that has access to this computer use. I see three 'needs' that need to be lock down on the user account:

1 - I need to disable the ability to install ANYTHING on the user account. (Locking users out of the add/remove programs would be good as well.)
2 - I need to lock people out of disabling anything in the system tray while still being able to use the system tray.
3 - I don't want users to be able to modify specific files (like the HOSTS file).

Also - is there any way (maybe with a script??) that a program can be enabled to do something every say 60 minutes? They utilize OpenDNS.org to keep their network 'safe' but the IP address is dynamic. The OpenDNS updater program is supposed to update the service whenever the IP address changes - but sometimes that doesn't happen (this is also the program they don't want disabled in the system tray while still allowing other system tray components to be used).

Any of this possible?

[glc]

I don't know the specifics, but I would think group policy would be what he wants to use. He will probably need to study up on it.

Run gpedit.msc.

[SonicVanguard]

Group policy does most of what he needs - the biggest one that we can't cover is limiting access to something in the system tray while allowing access to other programs in the system tray.