there is so much you can do to control your system. Setup a small domain, apply a few group polices to them and all is well. Also, don't set them up as admins or powerusers. Only make them Users. That will prevent most of the stuff you don't want them to do in the first place.
The group policy can augment or control. I preffer the augment way as control takes more resources.
if you need help with GP's just ask.
Good luck