Setting up a secure set of restrictions for company user...

I am setting up some new laptops that will travel to dispatchers homes for them to work from home. But we are concerned about how to keep them from screwing things up too terribly. I used to use controls back in the day to limit things like right clicking on the desktop, accessing "All Programs" and to remove many things from the start menu.

My goal is:
Icons on Desktop for programs they need. IE, Firefox, Mapping and the program to manage the towing company.

Nearly total lockdown of the Start Menu - I have done this but only because I used Right Click on Start Button > Properties but since this can be changed just as easily to put it all back I need to restrict that. I can always install new programs and then manually put a link on their desktop!

No changing Clock, accessing any resolution settings etc. But I still need them to be able to join a wireless network at will. I dont want to have to give out a password or to travel to their homes to setup the wireless networks.

Thank you guys for anything you can lend to my little dilemma here. I was able to find the Group Policy Editor, but if I use that I have to grant admin level privs to their user name? Or is there a way to tell the GP Editor to apply the setting to a specified user?

Chad

What operating systems will these laptops use? Your best option is to combine Local Security Policy and Group Policy. This thread may be of some help to you.

Most of those things are also possible by using standard user accounts, that directly prevent any writing to system critical areas, but still can execute programs and connect to wifi networks. In the event of anything requiring admin permissions, UAC will popup, asking for a password that the user will not know, unable to proceed. Also, a firewall with strict settings, specially for outgoing connections may help in reducing authorized usage, and an antivirus is obviously a must, helping too in case something sneaks in.

The only problem I think you can have is that, the people having physical access to the machine, it's entirely possible to boot with an external OS, making possible to access everything, and even deleting an admin password (incredibly easy with Windows), thus getting full control of the OS.