However, if we expand the question, and do take into account both Windows 2000 and Windows XP, the news still doesn't get much better. Windows 2000 users can install old-style "setup.exe" software, basically, where they have access. However, the news is slightly better for Windows 2000 clients if your users want to install .MSI files. Most MSI files will be restricted from completing installation (such as Office 2000 and higher). Note, that this is 100% .MSI file dependent, and the operating system has very little to prevent it.
The news is somewhat better for Windows XP clients. If you delve into Software Restriction Policies with Windows XP clients, you'll really get fine control over which applications can and cannot run. In my book, I have nearly a quarter of Chapter 6 dedicated to Software Restriction Policies, so I encourage you to check it out.
This was first published in January 2004