One way that we do this is to not allow programs like setup.exe and
install.exe to run. This is not a perfect solution but keeps most of our
users from installing crap. To enable and list the programs you don’t want run go to
User Configuration->Administrative Templates->System->Don’t allow
specified Windows applications in group policy editor.
If the users were not admins that would be a better solution.